More than 1.4 million files stolen from Berlin’s administration have been published on the dark web after a cyberattack on August 14, with hackers reportedly demanding about two million euros in ransom. The leaked material includes sensitive personal, financial and government-related information.
What Data Was Leaked From Berlin Administration?
The leaked material reportedly includes payroll lists, bank details, scans of identity documents and information about employees and addresses. Data relating to state civil servants is also said to include birth certificates, telephone numbers and home addresses.
The scale of the leak is reported at 1,439,893 files. Among the published material is a folder titled “AG CBRN-Rahmenplanung”, containing information related to chemical, biological, radiological and nuclear threats. Such information could potentially reveal details about threat scenarios and security measures.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Sensitive Government Information Was Exposed?
The published files reportedly include documents connected to investigations by the LKA, as well as plans concerning national defence. These include the federal government’s secret communication channels in the event of an apocalypse, documents related to defence companies and emergency plans developed by the government.
Investigative journalist described the cyberattack as being of a magnitude that required serious attention. The available information indicates that authorities are examining the published material and assessing the extent of the leak.
Also Read: https://the420.in/berlin-ransomware-attack-hacker-blackmail/
Why Did The Hackers Publish The Data?
The attack has been attributed to the Rhysida ransomware group. The hackers had reportedly demanded around two million euros and previously threatened to publish the stolen data on their leak site.
The hackers also demanded a ransom of 30 Bitcoin, according to the report. Berlin Mayor Kai Wegner rejected the payment, saying that paying would not have guaranteed the deletion of the stolen information.
The attack affected two city departments. Several administrations, including those responsible for housing and the environment, were disconnected from the network for about a week, while some services and payments were temporarily suspended.
After the ransom deadline passed, the stolen data was published on the dark web. Members of the hacker group have also reportedly begun sharing lists of filenames on social media. A central crisis unit is now analysing the published information and working to identify people whose data may have been compromised.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
