Berlin Refuses Ransom After Hackers Breach City's Administrative Network

Key points

• Berlin's state government has confirmed an extortion attempt tied to the August 2024 break-in of its state administrative network.
• Officials have publicly refused to pay the criminals anything.
• Investigators found extra data was stolen from the Senate Department for Mobility, Transport, Climate Protection and Environment.
• The city has not named the group behind the attack or said how the intruders first got in.
• Berliners whose records sit in transport or environment files may see their information surface online.

Berlin's state government has confirmed it's being blackmailed by the criminals who broke into the city's administrative computer network in August, and it won't pay.

The attack hit the network carrying traffic between the city's state offices, the shared plumbing behind everything from permits to internal email. Officials disclosed the extortion demand this week, alongside fresh findings from the forensic team still picking through the damage.

Those findings aren't comforting. Investigators now say more data left the building than first thought, specifically from the Senate Department for Mobility, Transport, Climate Protection and Environment. Files from the department that runs Berlin's transport and environmental policy were copied out by the intruders.

The city hasn't said what's in the stolen files, how many people are affected, or how much the criminals asked for. It also hasn't named the group behind the intrusion, as first reported by The Hacker News.

What actually happened?

Criminals broke into the network connecting Berlin's state government offices in August, quietly copied data and later returned with a ransom demand. Berlin has now said no in public.

This is the standard shape of a modern extortion attack. Intruders don't always scramble the victim's files with ransomware, malicious software that locks up systems until a payment is made. Increasingly they steal the data and threaten to publish it. That's called double extortion when both happen, or pure data extortion when only the theft is used as pressure. Berlin hasn't confirmed which type this is.

Refusing to pay is the position most European governments now take publicly, and the one law enforcement agencies push, because paying funds the next attack and doesn't guarantee the data stays private. When ShinyHunters dumped 12.9 million Carhartt customer records after a ransom refusal on 27 August, it was a stark reminder that walking away from a demand doesn't prevent publication.

Should Berlin residents be worried?

Possibly, but there's nothing to panic about yet. The city hasn't published a list of what was taken. If files from the transport and environment department are dumped online, they could include names, addresses or correspondence with residents.

Anyone who has dealt with that department, applied for a residents' parking permit or filed an environmental complaint, should watch for unusual emails referencing real details of past dealings. That's the classic sign of phishing, where criminals send fake messages using stolen context to trick people into handing over passwords or clicking bad links.

Banking details are unlikely to be in these files. Contact details and case history are the more realistic worry.

Would MFA have helped?

Honestly, we don't know yet, because Berlin hasn't said how the intruders got in. If the entry point was a stolen employee password reused from somewhere else, then yes: multi-factor authentication, the second check like a code from a phone app, would very likely have stopped the login cold. That's the single highest-value control for administrative networks and the honest answer in most public-sector breaches of this shape.

If the entry point was a software flaw in an internet-facing system, MFA wouldn't have mattered. The fix there is patching plus network segmentation, so a single foothold can't reach the transport department's file shares.

Berlin's forensic report, when it lands, should tell us which it was. Until then, the refusal to pay is the clearest signal the city has sent.