Germany's federal cyber agency has warned of a heightened threat situation after the Rhysida ransomware gang made good on its threat and published a 5.8-terabyte trove of data stolen from Berlin's state administration. The dump went online after the Senate refused to pay a ransom of 30 bitcoin — around two million euros — and let the group's deadline expire on Friday.
The BSI said the publication of stolen data creates 'various risks for those affected and ultimately for society.' It pointed in particular to the danger of so-called hack-and-leak operations in the political sphere ahead of elections: stolen documents and emails are published at a moment favorable to the attacker, possibly stripped of context. Berlin elects a new state parliament on September 20.
The agency said it does not believe the criminals pursued a political goal — the attack was probably 'exclusively financially motivated.' It did, however, warn of targeted phishing attempts following the data leak and noted that data touching on critical infrastructure, companies and organizations could raise the threat level further. Those affected should check whether their data is among the leaked material.
The attack on Berlin's administration became known in mid-August. German media report that the published package contains millions of partly sensitive records, including personal data of citizens.
