Berlin's Capital Offense: How Administrative Cheapness Handed 1.4 Million Files to Darknet Hackers

When the darknet becomes the most reliable archive for Berlin's state records, public governance has reached a dark milestone. The personal ID copy and digital signature of Transport Senator Ute Bonde are now freely available to anyone browsing the web's underbelly, alongside private correspondence from her predecessors, Manja Schreiner and Bettina Jarasch. Joining them in the digital abyss are 1.4 million files containing bank details, police clearance records, and personal health details of ordinary citizens who made the mistake of applying for municipal heating grants or soundproofing subsidies.

This catastrophe was not engineered by an incomprehensibly sophisticated state actor. The hacker collective Rhysida simply walked through a front door left unlocked by design. In a display of administrative penny-pinching that borders on systemic failure, the Senate Department for Urban Development admitted that anti-intrusion software introduced in 2026 was installed on a meager five percent of state computers and servers. The administration ran out of licenses, declaring full coverage impossible due to financial constraints. Predictably, both the workstation exploited by the attackers and the servers holding sensitive files belonged to the ninety-five percent left entirely unprotected.

This was no sudden, unpredictable misfortune. Berlin’s state apparatus had been warned repeatedly over several years. A mandatory statewide guideline from 2017 required administrative bodies to allocate sufficient funding and staff for cybersecurity. Unreleased reports from 2023 outlined grand plans for early threat detection, while official responses from 2024 acknowledged that necessary IT budgets were provided only partially. The Berlin Audit Office had previously flagged staggering oversights in other departments, discovering that the Justice administration lacked a functioning emergency management system and the Marzahn-Hellersdorf district office had gone two decades without updating its security concepts.

When Rhysida demanded 30 Bitcoin—approximately two million euros—between August 7 and August 12, the Senate stood firm and refused to pay. The extortionists responded on September 4 by dumping the stolen trove online. While the Senate Chancellery declared the immediate operational threat neutralized by mid-October, state authorities still cannot quantify how many citizens are left exposed to identity theft and fraud. The acute crisis may have quieted down, but the structural failure that enabled it remains fully active.

Written by Christiane Hofreiter christiane.hofreiter@alpineweekly.com