Berlin hit by cyberattack ahead of elections: 1.4 million records published on the darknet

Berlin’s administration has been hit by a serious cyberattack just days before elections for the parliament of the German capital.

About 1.4 million stolen records have been published on the darknet after authorities decided not to pay the amount demanded by the hackers.

The Rhysida cybercriminal group is suspected of being responsible for the attack, having managed to infiltrate the networks of the Building and Transport administrations.

The attackers demanded 30 Bitcoin, worth around two million euros, warning that they would publish the materials if payment was not made. “Berlin will not allow itself to be blackmailed,” Mayor Kai Wegner said.

After the financial demand was rejected, personnel files, official documents, payslips and copies of identity documents were distributed on the darknet. The exposed information may also include data related to power and heating plants, fuel depots, emergency power supply systems, prisons and waterworks.

Authorities said the hackers had access to the administrative systems between August 7 and 14.

Initial suspicions are that the breach began after a Transport Administration employee opened a phishing email, inadvertently giving the attackers an opportunity to access the network.

The Berlin Senate has established a coordination center and is working with the federal authorities responsible for cybersecurity. According to the authorities, the election infrastructure has not been affected, and voting for the Berlin Parliament, scheduled for September 20, is not at risk.

The published materials also include documents related to the controversial project to expand the Federal Chancellery, indirectly affecting Chancellor Friedrich Merz as well.