What Happened
Between August 7 and 12, attackers infiltrated Berlin's state government network, extracting data from the Senate Department for Mobility, Transport, Climate Protection, and the Environment. The breach went undetected for at least two days, and affected departments weren't isolated until August 14.
The Rhysida ransomware gang claimed responsibility, listing 5.79 TB of stolen data across 1.44 million files on its leak site. The data included mapping and geodata, legal files, financial records, contracts, HR files, and confidential material. They also claimed to have plaintext credentials from internal systems, including building-management and payment-processing databases.
Rhysida demanded 30 bitcoin (about 2 million euros). Governing Mayor Kai Wegner responded, "The state of Berlin is being blackmailed. Berlin has fallen victim to a serious crime." The city refused to pay.
Timeline
August 7-12: Attackers accessed the Senate network and exfiltrated data. The breach went undetected during this period.
August 14: Affected departments were disconnected from the state network, marking a significant two-day gap between breach detection and containment.
Late August/Early September: A forensic investigation revealed the full scope of the data leak.
Following an emergency Senate session: Wegner and Interior Senator Iris Spranger confirmed the extortion attempt and announced the no-payment stance. The State Criminal Police Office, public prosecutor's office, and federal security agencies began a coordinated investigation.
Which Controls Failed or Were Missing
Network segmentation: The lack of segmentation allowed attackers to access the broader state network for at least five days before isolation.
Credential management: Rhysida's claim of plaintext credentials indicates poor password storage practices, affecting leadership and critical systems.
Detection capability: A five-day detection gap, followed by a two-day delay in containment, highlights inadequate monitoring. The breach was discovered through forensic investigation, not real-time alerts.
Data classification and access control: The wide range of exposed data suggests a flat permission structure, allowing access to sensitive information across different departments.
Encryption of data at rest: The attackers' ability to categorize 1.44 million files suggests data wasn't encrypted in storage, or they obtained decryption keys.
What the Relevant Standard Requires
NIST SP 800-61 outlines rapid detection as crucial in the Incident Response Lifecycle. A five-day undetected intrusion violates this principle.
ISO/IEC 27002 Control 8.11 requires data masking, and Control 8.24 mandates encryption of sensitive information. Plaintext credentials contradict these requirements.
NIST SP 800-53 Controls AC-4 and SC-7 require network segmentation to contain breaches. Berlin's flat network allowed lateral movement across departments.
CIS Controls v8.1 Controls 3.3 and 3.12 address permission-structure failures, while Control 6.5 would have prevented the credential-storage issues Rhysida exploited.
NIS2 Directive Article 21 requires critical entities to implement incident detection and response measures. The detection gap here falls short of that obligation.
Lessons and Action Items for Your Team
Detection speed is critical if you refuse to pay. Berlin's no-payment stance was defensible, but the five-day detection gap weakened it. Rhysida had time to inventory and package data before detection. Deploy behavioral analytics on privileged accounts and file-access patterns to detect bulk exfiltration within hours.
Audit credential storage across applications. Ensure secure-storage practices are followed. Scan for plaintext passwords in databases and application code. If found, prioritize remediation.
Map data flows and segment networks. Ensure departments like transportation don't share network space with HR, financial, and classified systems. Establish boundaries based on data sensitivity and job function.
Prepare stakeholders for a no-payment decision. Wegner's clear stance worked because the decision was premeditated. Document your rationale now, get board-level agreement, and make it policy.
Include a public-disclosure section in your Incident Response Plan. Berlin's coordinated response shows the importance of preparation. Specify who will speak, when, and what language to use. Ensure legal review and stakeholder alignment before making public statements.
Test your forensic-investigation capacity. Berlin's ongoing analysis highlights post-incident complexity. Ensure your team can handle large datasets and identify sensitive information.
The no-payment stance is a policy choice, not a technical control. It only works if your technical controls limit what attackers can take while you decide not to pay.
