Berlin Refuses to Pay Ransom for Stolen City Network Data

The government of the federal state of Berlin has officially acknowledged that it fell victim to an extortion attempt after its municipal administrative network was compromised in August, and it has declared that it will not comply with the criminals' demands. “The state of Berlin is being blackmailed,” said Governing Mayor Kai Wegner following an extraordinary session of the Senate at the Red City Hall.

What happened

The authorities first reported the incident on 17 August: a forensic analysis established that the network had been breached, and the two affected agencies had already been isolated the previous Friday. In the course of the further investigation, it emerged that data had also been leaking from the remit of the Senate Department for Mobility, Transport, Climate Protection and the Environment — the exfiltration is dated to the period from 7 to 12 August. The department itself reported the leak on 7 August, yet it was not disconnected from the network until the 14^th, a week later.

The volume and contents of what was stolen are still being examined. The Senate Chancellery does not rule out that personal and other non-public information may have been among the data, but Berlin has published no official figures on the scale of the leak. The only detailed estimate comes from the attackers themselves.

The Rhysida trail

According to Der Spiegel, responsibility is attributed to the Rhysida group: on 28 August an entry titled “Berlin, Germany” appeared on its darknet site. The attackers claim to have scanned 5.79 terabytes of data and around 1.44 million files, and to hold personal information on 12,076 people. The largest category is nearly 125,000 files of maps and geodata. The entry does not state a ransom amount.

The authorities have not yet named a specific group: the investigation is being conducted by the state criminal police, the public prosecutor's office and federal security bodies. A joint 2023 advisory from CISA, the FBI and MS-ISAC describes Rhysida's typical modus operandi — entry via VPN using stolen credentials in the absence of multi-factor authentication, exploitation of the Zerologon vulnerability, and phishing. In the same document the agencies explicitly advise against paying the ransom: payment does not guarantee recovery and only spurs the attackers on.

Consequences

While the agencies were disconnected from the network, the intake and disbursement of housing benefits was down; all Senate departments restored their connections on 23 August. Interior Senator Iris Spranger stressed that data relating to the conduct of the 20 September House of Representatives election had not left the network, and that her staff consider the electoral infrastructure secure. The Berlin State Commissioner for Data Protection and the federal BSI agency are being kept informed on an ongoing basis, but the authorities have not yet published any guidance for citizens whose records may have ended up in the leak.

Source: The Hacker News