Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin's government confirmed a data breach affecting its state administrative network and flatly refused to pay ransom to the attackers who compromised the system in August. The city's authorities disclosed the incident after forensic investigation revealed additional data exfiltration from the Senate Department for Mobility, Transport, Climate Protection and Environment beyond the initially identified breach.

The attack represents a significant operational security incident for one of Germany's largest administrative systems. Hackers gained access to Berlin's state network and subsequently demanded payment in exchange for not disclosing or selling stolen data. The extortion attempt follows a pattern common among modern threat actors who combine data theft with ransomware deployment or pure data-theft-and-extort tactics.

Berlin's refusal to negotiate positions the city against a core revenue stream for ransomware and data theft operations. By publicly stating it will not pay, the administration removes financial incentive for attackers to negotiate or delay public disclosure. This approach aligns with guidance from cybersecurity authorities worldwide, which discourage ransom payments as they fund criminal operations and encourage future attacks.

The forensic investigation uncovered scope beyond initial damage assessments. The Senate Department for Mobility, Transport, Climate Protection and Environment systems leaked data, suggesting attackers maintained deeper access or exfiltrated information from multiple departments. The nature of this data remains undisclosed, though Berlin's administrative networks typically handle infrastructure planning, environmental records, transportation databases, and citizen information.

The August compromise timeline indicates the breach occurred approximately several months before public disclosure. This delay reflects the time required for threat actors to identify valuable data, exfiltrate it, and prepare extortion demands. Forensic teams meanwhile worked to reconstruct the attack chain, identify compromised systems, and assess data loss scope.

Berlin joins other major government entities targeted by data theft and extortion operations. Unlike some smaller municipalities that have paid attackers to prevent disclosure or recover systems, the German capital's stance demonstrates institutional resistance to criminal demands. This approach carries risk. Attackers may publicly release stolen data as retaliation, potentially exposing sensitive information about city infrastructure, employee records, or planning documents.

The incident underscores vulnerabilities in critical government infrastructure despite Germany's strong cybersecurity regulations and frameworks. State administrative networks face persistent targeting from financially motivated threat actors and state-sponsored groups seeking intelligence or leverage.

Berlin has not named the threat actor responsible for the breach. No public claims of responsibility have emerged from known ransomware gangs or hacking groups, though attribution may follow if attackers release stolen data or publish details about the operation. The lack of disclosed indicators of compromise limits third-party organizations' ability to assess attack methodology or defend against similar intrusions.

The city must now navigate data notification requirements under German privacy law and the GDPR. Affected individuals face potential identity theft or fraud risk depending on what data was stolen. Berlin's administrative network breach serves as a reminder that government institutions, despite resources and security investments, remain vulnerable to sophisticated attackers willing to target public sector infrastructure for financial gain.