Executive Summary
In August 2026, the Rhysida extortion group breached the networks of two Berlin Senate administrations (SenStadt and SenMVKU), exfiltrating approximately 1.44 million files totaling over 5 TB. The attack focused on stealing unstructured data from shared and personal employee directories rather than specific application databases. Berlin officials refused a ransom demand of 30 BTC, leading the group to publish the full archive on their dark web leak site on September 4, 2026.
The technical impact is severe due to the volume of 'secrets' leaked, including nearly 3,900 certificate and private-key stores, dozens of password-manager databases, and hundreds of files containing plaintext credentials. This has transformed the incident from a data breach into a long-term credential-reuse and infrastructure-compromise problem. While attribution remains formally open, the tradecraft is consistent with Rhysida's known patterns, including potential exploitation of Zerologon (CVE-2020-1472) and phishing.
The breach had significant business impact, stalling public housing and family support payments for over a week while systems were disconnected. It also prompted federal warnings regarding potential phishing waves targeting the state election, although the election itself was not directly compromised. The incident highlights the extreme risks of flat network architectures and the storage of plaintext administrative secrets on general file shares.