hacker-news · Crawled Sep 1, 2026
Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
1 IoCs 1 Actors 1 CVEs
Read original article ↗
AI Summary
The state government of Berlin confirmed a ransomware attack and data exfiltration from its administrative network between August 7 and August 12, 2026, attributed to the Rhysida ransomware group. The attackers claimed to have stolen 5.79 terabytes of data, including personal information on over 12,000 individuals, and published a post on their darknet leak site on August 28. Despite the extortion attempt, Berlin has refused to pay the ransom. Forensic investigations are ongoing, and affected departments were isolated before being reconnected on August 23.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 1 extracted
| Type | Value | Detail |
|---|---|---|
| Domain | rhysida-leak[.]onion | Details → |
MITRE ATT&CK TTPs 15 techniques
T1078 Valid Accounts · Defense Evasion T1133 External Remote Services · Persistence T1484.001 Group Policy Modification · Defense Evasion T1566 Phishing · Initial Access T1018 Remote System Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1075 T1075 T1082 System Information Discovery · Discovery T1089 T1089 T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1485 Data Destruction · Impact T1550 Use Alternate Authentication Material · Defense Evasion