What went down (short version)

Okay, picture this: Berlin’s state administrative network got poked, prodded and looted in August. The city says it was hit by an extortion attempt and has made the headline-worthy decision to refuse the ransom. Forensic teams found additional data exfiltration tied to the Senate Department for Mobility, Transport, Climate Protection and Environment that happened between August 7 and August 12 — then parts of the network were cut off on August 14.

The attackers themselves posted a leak claiming roughly 5.79 terabytes of material and personal info on thousands of people. Berlin hasn’t published an official tally. Investigators — state criminal police, the public prosecutor and federal security agencies — are on the case, and authorities say they haven’t publicly pinned the attack to any one group yet.

Local officials insist the election infrastructure for a September vote looks unaffected for now, and essential services were largely restored after departments were isolated and scanned. Still, the forensic work is ongoing and the full scope of what was taken is not yet confirmed.

Why this matters and what to do

Beyond the political drama, the incident is a reminder of how attackers actually break in and what you can realistically do to make life harder for them. National and international advisories that track these groups list a few common entry routes:

  • Compromised credentials used to access external remote services and VPNs — especially where organizations don’t require extra verification.
  • Zerologon (CVE-2020-1472) — an old but nasty elevation-of-privilege bug that has been exploited widely in the past.
  • Phishing — because humans are still remarkably click-happy when presented with a convincing email.

Authorities generally recommend prioritizing patching known vulnerable systems, segmenting networks so an intruder in one corner doesn’t roam free everywhere, and, yes, turning on multi-factor authentication. If you run a network, do the sensible thing: enable MFA where you can, patch urgently, and assume an attacker will try the human route.

Also: paying a ransom is not a magic fix. Agencies warn payments don’t guarantee data recovery and can invite repeat targeting.

There was a separate but related security flap at a major airport operator around the same time, where a third party accessed customer booking and Wi‑Fi sign-up info. No operational safety systems were affected, and no payment card data was reportedly involved, but millions of customers were told to watch for suspicious communications.

Bottom line: Berlin refused to be blackmailed, investigations are underway, and the practical lesson for organizations is the same as it always is—patch, segment, train users, and protect logins with multi-factor checks. Boring? Maybe. Effective? Absolutely.