Disconnecting an attacker ends access. It does not recall the files already taken.

On September 4, Berlin said data stolen from its administration had been released after an extortion deadline expired. That moves the Landesnetz incident into a harder phase: finding which identities, credentials, operational documents, citizens, and businesses can now be abused by people who had nothing to do with the original intrusion.

TL;DR

  • Berlin confirmed data exfiltration from two Senate administrations before they were disconnected from the state network on August 14.
  • A group calling itself Rhysida claimed responsibility and claimed to hold 5.7 terabytes. That volume remains an attacker claim, not a verified inventory.
  • Berlin said on September 4 that the published dataset was under urgent forensic examination and that identifiable victims would be contacted on a risk basis.
  • No public evidence currently establishes a nation-state operation, the initial access vector, or the full content of the released material.
  • The defensive priority is no longer only containment. It is invalidating exposed trust before stolen information is reused.

What Changed

Berlin previously confirmed that data left systems in the mobility, transport, climate protection and environment administration between August 7 and 12. The affected mobility and urban-development administrations were separated from the Landesnetz on August 14, and the wider network remained under forensic examination.

By September 4, Berlin publicly named Rhysida as the group claiming responsibility. The group claimed to have stolen 5.7 terabytes and demanded 30 bitcoin. After the deadline expired, Berlin reported that experts believed the full offered dataset had been published on the dark web.

Those statements do not make every criminal claim true. The state is still examining the files, and the public record does not yet confirm the precise volume, complete victim population, initial foothold, or whether every advertised document is authentic. That uncertainty is part of the incident, not a reason to wait.

Publication Creates New Attack Paths

A leaked document does not need to contain a password to be operationally useful. Internal contact lists improve impersonation. Project names make phishing believable. Network diagrams shorten reconnaissance. Contracts reveal suppliers and renewal cycles. Case files can expose people already at risk.

Credentials are more direct. Any passwords, API secrets, private keys, session material, recovery codes, or service-account details found during review should be treated as compromised even if there is no evidence they have been used. Rotation must include every system where the same secret or password was reused.

The likely downstream chain looks like this:

Published government data
        -> identities and internal context extracted
        -> targeted phishing, fraud, or credential reuse
        -> access to a separate service or supplier
        -> a new incident with legitimate-looking authentication

This is why the breach clock does not stop when the attacker leaves.

The Post-Publication Playbook

Start with secrets, not file counts. Search the confirmed corpus inventory for password patterns, connection strings, tokens, certificates, recovery material, VPN profiles, and privileged service documentation. Build a rotation register with an owner, affected systems, completion time, and verification evidence for each item.

Then classify human risk. Government data can affect employees, citizens, contractors, witnesses, applicants, and businesses differently. Notification priority should follow credible harm: identity theft, physical safety, legal confidentiality, account takeover, or targeted fraud. A generic breach email is not enough for a person whose leaked file creates a specific danger.

Preserve a trustworthy copy of the evidence and its metadata. Do not ask ordinary staff to browse criminal leak infrastructure. A controlled forensic team should record hashes, provenance, and access controls while legal, privacy, and security teams work from an indexed internal inventory.

Finally, monitor for reuse rather than only replaying the original indicators. Alert on password resets followed by unusual enrollment, new MFA methods, dormant-account access, supplier impersonation, abnormal document sharing, and authentication from infrastructure unrelated to normal government operations.

Defensive Plan: Action, Reason, Proof

OwnerActionWhy it interrupts the next attackHow to verify it worked
IAM teamBuild a list of exposed passwords, API tokens, private keys, certificates, recovery codes, and service accounts. Revoke active sessions first, then rotate each secret everywhere it was reused.A password change does not invalidate every session or derived token. Attackers can also reuse the same secret against a supplier or legacy service after the primary account is changed.Test that the old password, token, certificate, and session all fail. Record the replacement identifier and last successful use of the old credential.
Data owners and privacy teamMap each exposed data category to affected people, systems, retention rules, and credible harms such as identity fraud, physical safety, or legal confidentiality.File count does not determine risk. Classification identifies who needs urgent protection and prevents high-risk records from waiting behind low-impact material.Every reviewed collection has an owner, harm rating, notification decision, and documented rationale; high-risk cases have a named case handler.
SOCCreate detections for first-seen MFA enrollment, dormant-account use, supplier impersonation, unusual password resets, and authentication from new infrastructure involving exposed identities.Downstream attackers may use valid credentials and accurate internal context, so the original malware indicators will not describe the next intrusion.Run test events for each rule and confirm they create an alert containing the identity, source, affected service, and exposure-record reference.
Supplier managementNotify connected agencies and vendors whose shared projects, contacts, or credentials appear in the exposure inventory. Rotate shared secrets from both sides.A supplier can become the easiest place to reuse Berlin-specific information even when Berlin’s own account has been secured.Obtain written acknowledgement, new credential identifiers, and authentication logs showing that the retired trust path is no longer accepted.
Incident response and legalAcquire the published corpus through a controlled forensic process, hash it, restrict access, and provide indexed results to authorized reviewers.Sending staff to criminal infrastructure creates additional exposure and destroys confidence in provenance. A controlled copy supports notification and later legal evidence.Preserve acquisition time, hashes, source, access log, and chain-of-custody record; periodically verify the working copy against the preserved hashes.

The first measurable milestone is not “all files reviewed.” It is “every confirmed high-impact secret is invalid, every high-risk person has an owner, and detections for reuse have passed a test.”

Berlin’s decision not to pay removed one attacker-controlled decision point. It did not remove the stolen data. Recovery now depends on how quickly the state can turn an unknown archive into a defensible list of identities, secrets, systems, and people at risk.

Sources