A Major Disaster in Berlin

Hackers Post Highly Sensitive Emergency Data Online

After no ransom was paid, the criminal hackers carried out their threat and posted the stolen Berlin administrative data on the dark web.(Bild: APA/dpa/Philip Dulian)

The German capital, Berlin, has been rocked by a data disaster: Hackers stole highly sensitive material during a cyberattack on the city administration and demanded a ransom in the millions. After an ultimatum expired, the criminals have now posted the data on the dark web.

The stolen data includes emergency plans containing sensitive details—such as the cell phone numbers of officials—as well as vulnerability analyses of the drinking water supply, documents related to construction projects and hiring procedures, and private data belonging to civil servants. Confidential documents from Bundesrat committees are also likely among the stolen materials. In addition, the extortionists boasted that they had obtained login credentials and passwords in plain text—including those for government databases and payment service providers.

Huge Amount of Data
Given the massive volume of approximately 1.44 million files, which occupy more than five terabytes of storage, there is still no clear picture of the damage the data leak will cause Berlin. What is clear, however, is that this poses a massive data protection and security risk. IT experts are examining exactly which files were published, as the city government announced on Friday evening.

Expert Sees Terrorist Threat
German investigative journalist Lars Winkelsdorf, who has reviewed the data, believes that terrorist groups active on the dark web have already downloaded these files. He therefore warned the newspaper “Bild” of potential terrorist attacks on Berlin.

“Quite Unpleasant”
“This is certainly an uncomfortable situation for the Berlin administration,” IT expert Joachim Selzer told the German Press Agency, “as this naturally involves a great deal of internal data not intended for public consumption. I see, for example, personnel matters and employment references. Criminals can always find a way to exploit such data.”

Risk of Identity Theft
The spokesperson for the hacker NGO Chaos Computer Club sees the leak as posing a particular risk of identity theft. For example, the data includes an application for a new cell phone—complete with the administrative employee’s signature. “That means I already have sample signatures, which is quite handy for some criminals,” said Selzer. The expert assumes, however, that the data will likely be misused for criminal purposes in the medium term. “It’s a huge dataset; someone will have to go through it first.”

Website with a Countdown
The cyberattack by the criminal hacker group Rhysida on the Berlin administration came to light in mid-August. The extortionists demanded a ransom of 30 Bitcoin—about two million euros—for the data. They set up a website on the dark web for the leaks, where they posted a countdown that expired on Friday afternoon. Once the deadline passed, the “auction” ended and the data was published. “All files have been uploaded to the publicly accessible section—have fun browsing, data hunters!” the website stated.

The data is now in the hands of criminals.

IT-Sicherheitsexperte Christof Fischer

The Berlin Senate had previously reaffirmed that it would not comply with such blackmail attempts and would not pay a ransom. This decision was met with approval among experts. T-Security expert Christof Fischer pointed out that, by law, the government is not permitted to make payments in cases of blackmail.

Are the perpetrators trying to buy protection?
However, the situation in incidents like the one in Berlin is very difficult: “The data is in the hands of criminals, and in many cases, its release has very harmful consequences. So far, I am not aware of any case where a payment was made and the data was still released.” However, it is reasonable to assume that the perpetrators—who mostly live in Eastern European countries—made this data available to the authorities there in order to buy protection from investigations against themselves, Fischer told the dpa.