What Happened
In mid-August, Berlin's city administration discovered unauthorized access to its network. On August 28, the Rhysida ransomware gang claimed responsibility, stating they'd exfiltrated 5.79 TB of data, including 1.44 million files. The stolen data encompassed government records, plaintext credentials, database accounts, personnel files, critical infrastructure assessments, and documents marked as nondisclosure agreements.
The Senate Department for Mobility, Transport, Climate Protection, and the Environment was among the affected entities. Mayor Kai Wergner announced the city wouldn't pay the ransom. The State Criminal Police Office, public prosecutor's office, and federal security agencies are investigating.
Timeline
August 7-12: Forensic investigators believe data exfiltration occurred during this period from at least one Senate department.
Mid-August: The city's IT team discovered the breach.
August 14: Affected Senate departments were disconnected from the state network.
August 28: Rhysida publicly listed Berlin on their data leak site and gave the city four days to pay before publishing the stolen files.
This timeline reveals a critical gap: five to seven days elapsed between initial exfiltration and discovery, followed by two weeks before public disclosure. This allowed attackers time to move laterally, escalate privileges, and systematically extract data from multiple departments.
Which Controls Failed or Were Missing
The attackers' success highlights where Berlin's defenses broke down:
Credential exposure: The stolen data included plaintext credentials, database accounts, and password vaults. This suggests credentials were stored in accessible formats or locations not adequately segmented from general administrative systems.
Lateral movement containment: The breach affected multiple Senate departments, indicating insufficient network segmentation. Attackers could traverse between departments rather than being confined to a single system.
Data classification and access controls: The exfiltration of 3,200+ documents marked as nondisclosure agreements and critical infrastructure assessments shows sensitive data wasn't adequately protected by access restrictions tied to user roles or data sensitivity levels.
Privileged access monitoring: The theft of credentials belonging to senior officials suggests privileged accounts weren't subject to enhanced monitoring or behavioral analytics to flag unusual access patterns.
Exfiltration detection: Moving 5.79 TB of data should trigger network anomaly alerts. The lack of detection during the exfiltration window indicates insufficient data loss prevention controls or network traffic analysis.
What the Standards Require
NIST CSF Core Functions highlight these failures:
Under Identify (ID.AM), organizations must maintain inventories of data assets and information flows. Berlin needed classification labels on sensitive documents and a clear map of where credentials and classified material resided.
Under Protect (PR.AC), the framework requires identity management and access control, specifically PR.AC-1 (identities and credentials are issued, managed, and verified) and PR.AC-4 (access permissions are managed). Plaintext credentials and accessible password vaults violate these requirements.
Under Detect (DE.CM), continuous monitoring must include network traffic analysis (DE.CM-1) and detection of anomalous data flows (DE.CM-7). The multi-day exfiltration window suggests these capabilities were absent or ineffective.
Under Respond (RS.RP), response planning must include procedures for containing incidents. The two-week gap between discovery and department disconnection indicates response procedures weren't pre-staged or tested.
NIS2 requirements are particularly relevant for critical infrastructure entities like Berlin's water supply systems, whose security assessments were stolen. Article 21 mandates measures for securing network and information systems, including access control, asset management, and incident handling. The breach of water infrastructure assessments suggests these controls weren't extended to documentation about critical systems, even if the systems themselves were protected. Network and Information Security Directive (NIS2)
Lessons and Action Items for Your Team
Audit your credential storage now: Search your environment for plaintext passwords, accessible password vaults, and credentials in configuration files or scripts. If you find them, you're one breach away from full domain compromise. Move to a secrets management platform with encryption at rest and role-based access.
Test your segmentation under attack conditions: Don't assume VLANs or firewall rules will contain a breach. Run tabletop exercises where you assume an attacker has one set of valid credentials and map how far they could move. If the answer is "everywhere," your segmentation isn't functional.
Set data exfiltration thresholds by user role: A typical administrative user doesn't download terabytes of data. Configure your DLP and SIEM to alert on volume thresholds appropriate to each role. For sensitive data classifications, set the threshold near zero.
Implement privileged access workstations: Senior officials' credentials are high-value targets. Separate privileged activities onto dedicated, hardened workstations that can't be used for email or web browsing. This limits the attack surface for credential theft.
Pre-stage your containment playbook: Berlin took two weeks to disconnect affected departments. Your incident response plan should include pre-approved procedures for isolating compromised segments within hours, not weeks. Document the decision tree: who can authorize disconnection, which systems can be isolated without approval, and how to maintain essential services during containment.
Classify data before you need to report its theft: Berlin's investigation is still determining the extent of data theft. If you don't know what's sensitive until after it's stolen, you can't prioritize containment or meet breach notification requirements. Tag sensitive data now with retention policies and access restrictions.
The Berlin attack isn't unique in its techniques. It's instructive because the stolen data inventory reads like a checklist of control failures. Your job is to ensure that checklist doesn't describe your environment when your forensic team writes their report.
