After cyberattack, sensitive Berlin data appears online. What risks come next?

The extortion threat against Berlin’s administration has been carried out. Three weeks after hackers broke into parts of the city’s state network, the group Rhyside published large quantities of stolen data online.

The attackers gained unnoticed access between Aug. 7 and Aug. 12 and extracted data from the Senate administrations responsible for construction and transport. The administration detected the breach on Aug. 14 and made it public three days later. Investigators later found that the stolen material amounted to 1.44 million files, totaling 5.8 terabytes.

Rhyside demanded 30 Bitcoin, equivalent to about 2 million euros. The Senate refused to pay. After its deadline expired, the group released the data on Friday on the darknet, a part of the internet that ordinary search engines do not index. The Federal Office for Information Security says communications there are encrypted and users and content providers seek to remain anonymous.

The full contents remain difficult to assess because of the volume of material. The Chaos Computer Club said the files included personal information about administrative employees, personnel matters, work references and emergency plans. The Tagesspiegel reported that the leak also contained information relevant to the security of Germany and Berlin, including details about heating plants, fuel depots, backup power systems and substations, as well as prisons, waterworks, arms companies, the Bundeswehr and Berlin’s interior administration.

Chaos Computer Club spokesman Jochim Selzer said he had reviewed some documents and found sensitive information about the condition of Berlin’s water supply. IT expert Manuel Atug said he had not accessed the darknet material himself for ethical reasons, but had learned from reliable sources that reports about civil protection and arms companies were accurate.

“

The files include personal data of administrative employees, personnel matters, work references and emergency plans.