Berlin tightens safeguards after credentials published in stolen data package
The State of Berlin is urgently reviewing an additional package of stolen data that contained credentials and was published during the night ending 6 September. The package followed the 4 September publication of files taken from the state administration. The Senate Department for Urban Development, Building and Housing subsequently reviewed and tightened safeguards for affected specialist systems, while forensic work continued.
In a dpa report published by Berlin.de on 8 September, Berlin’s Chief Digital Officer, Florian Hauer, said the continuing review had not identified higher-sensitivity or nationally important information among the published material. The assessment was preliminary. Authorities had not finalised the file count, established how many people were affected or confirmed whether the published credentials were current, valid or misused.
The victim is Berlin’s state administration, not Germany’s federal government. The compromise affected systems used by two bodies: the Senate Department for Mobility, Transport, Climate Protection and the Environment, and the Senate Department for Urban Development, Building and Housing.
Exfiltration preceded network isolation
Berlin’s investigation placed the relevant data exfiltration between 7 and 12 August 2026. The two departments were isolated from the state network on 14 August. The state publicly confirmed the compromise three days later, saying forensic work had identified the intrusion.
Both departments were reconnected over the weekend ending 23 August after immediate security measures were applied, although heightened monitoring continued. On 26 August, Berlin said investigators had identified further exfiltration within the area of the mobility, transport, climate and environment department.
The state confirmed an extortion attempt on 28 August and said it would not submit to the demand. On 3 September, Berlin reported that a group calling itself Rhysida claimed to hold 5.7 TB of data and had offered the material with a minimum bid of 30 BTC. Authorities warned that publication could follow.
Berlin confirmed on 4 September that stolen administrative data had been published. A central unit led by the Chief Digital Officer was established the following day to prioritise examination of the files and coordinate support and notifications. During the night ending 6 September, another package was published, this time containing credentials.
File counts remain unsettled
The scale of the stolen material has been described using figures that remain subject to validation. Tagesschau reported that the archive contained approximately 1.44 million files totalling 5.8 TB. By contrast, the 8 September Berlin.de and dpa report cited Hauer as referring to more than 1.2 million files under examination.
No reason has been established for the difference between those file counts. The reported volume also varies from the 5.7 TB claimed by the group using the Rhysida name. The file figures are not confirmed counts of records, people or victims, and the completeness of the published packages remains unresolved.
Hauer also said any affected classified material identified in the continuing review was limited to VS-NfD, Germany’s lowest classified-information level. This remained a preliminary assessment rather than a final account of the leaked material.
Rhysida attribution remains unconfirmed
Berlin has acknowledged Rhysida’s claim of responsibility, but the reviewed official material does not show that police or forensic investigators have independently attributed the intrusion to the group. It does not identify an affiliate or establish who operated the attack infrastructure. The attribution therefore remains a low-confidence self-claim rather than a completed law-enforcement finding.
Berlin has also not confirmed that ransomware encrypted any systems or that Rhysida malware was deployed. The available evidence establishes a network compromise, data exfiltration and subsequent publication, but it does not reveal the initial-access method. No exploited product, affected software version or CVE has been identified.
With no disclosed technical cause or software-version scope, Berlin’s response has focused on containment, forensic investigation, scanning, credential-related safeguards and continued monitoring of the reconnected departments.
Administrative services felt the disruption
The isolation of the two departments affected administrative processes that relied on the mobility department’s technical infrastructure. The Friedrichshain-Kreuzberg district reported that some traffic orders, construction-related special-use applications and exemptions could not be viewed or processed while systems were unavailable.
Berlin warned after reconnection that isolated disruption and workflow delays could continue. Safeguards introduced after credentials appeared in the 6 September package could also cause short-term restrictions in specialist systems used by the urban-development department. The duration and full cost of the residual disruption have not been disclosed.
Response turns to notification and support
An IKT emergency team has coordinated forensic work and network-security measures with Berlin police, prosecutors and the BSI. The state data-protection authority and other state and federal security bodies are also involved. As of 3 September, Berlin reported no evidence that the state network remained infiltrated, although the investigation continued.
The central coordination unit is assessing leaked material and arranging support for employees, citizens and businesses. Identified people are to be notified according to the risk associated with their exposed information. Berlin has advised anyone with evidence that their data was published, or used for fraud or identity misuse, to report the matter to police.
For Australian state, territory and local governments, the incident has indirect relevance rather than a confirmed local impact. No Australian victim or affected infrastructure has been identified. The Berlin case nevertheless highlights how a compromise within a shared public-sector network can interrupt administrative workflows, placing network segmentation, credential response and coordinated incident management at the centre of containment.
Berlin’s continuing review must still determine whose information was exposed, how sensitive it is and whether further packages exist. The initial-access route, any use of encryption, the validity of the published credentials and the extent of completed remediation all remained unknown at the 9 September evidence cutoff.
Network segmentation and credential response are separate disciplines that can converge during containment across shared government systems. For a structured next step, The Hack Academy’s online cybersecurity training programme lists networking and cybersecurity fundamentals, with self-paced learning and practical exercises alongside theory.
