Hackers publish six terabytes of sensitive Berlin government data

The hacker group Rhysida has published nearly six terabytes of data stolen from the administration of the state of Berlin, the city-state that is also Germany's capital, on the dark web. The data package includes 1,439,893 files. According to initial checks, some of the documents contain information that is extremely critical for public security.

The leak came after Berlin authorities refused to pay a ransom. The hackers had demanded 30 bitcoin, around two million euros, threatening to publish the documents on their own dark web site otherwise. The Berlin Senate, the Land's government, had made clear even before the ultimatum expired that it would not give in to this kind of demand as a matter of principle, and ignored the threat. The countdown set by the hackers expired on Friday shortly after 3:35pm. Shortly afterwards, the leak appeared on the dark web.

Sensitive documents and personal data

Among the published files is a folder named "AG CBRN-Rahmenplanung", dedicated to planning around chemical, biological, radiological and nuclear risks, hence the acronym CBRN. Investigative journalist Lars Winkelsdorf wrote on X that the attack had a "dimensione tale da minacciare la sicurezza dello Stato" (a scale that threatens the security of the state). According to Winkelsdorf, the leaked material "contiene non solo documenti del LKA, la polizia criminale del Land, relativi a indagini, ma anche piani che riguardano lo stato di difesa, fino ai canali di comunicazione segreti del governo federale per l'eventualità della fine del mondo" (contains not only documents from the LKA, the Land's criminal police, related to ongoing investigations, but also plans concerning the state of defence, down to the federal government's secret communication channels for a doomsday scenario).

The package also includes numerous personal data of Berlin public officials: birth certificates, what appear to be attendance records, phone numbers and home addresses.

On social media, members of the Rhysida group have already circulated lists of the leaked file names, confirming the scale of the attack. So far, few official reactions have come from Berlin's administration and political circles.