Summary
- Berlin confirmed on 6 September that a second package of stolen data included access credentials.
- The affected Senate administration strengthened controls, warning that access to specialist applications could be temporarily restricted.
- Authorities are still assessing the wider stolen dataset, leaving credential reuse and secondary compromise among the continuing risks.
Berlin’s government cyber incident has moved into a more difficult recovery phase after the city confirmed that attackers published another package of stolen data containing access credentials.
The State of Berlin said the additional material appeared overnight into 6 September following the attack on the Berlin state network. The Senate Chancellery said the release included access credentials, prompting the administration responsible for urban development, construction, and housing to review and strengthen measures introduced after the earlier publication.
The additional controls may temporarily restrict the use of specialist applications within the affected administration. Berlin has not publicly specified which credentials were exposed, whether they were still valid when published, or which systems they could access.
Those unanswered questions determine how far the second release changes the technical exposure. Stolen documents principally create confidentiality, privacy, and intelligence risks; credentials can also provide a route into connected services, support impersonation, or be reused against accounts outside the system from which they were originally taken.
The latest disclosure follows the compromise involving Berlin departments responsible for urban development and housing, and mobility, transport, climate protection, and the environment. Systems were isolated as authorities investigated the intrusion and the removal of data from the state network.
A group using the Rhysida name has claimed responsibility and claimed to have taken roughly 5.7 terabytes of information. Berlin has not independently verified that volume, and the attribution and dataset size should remain separated from the facts the city has confirmed itself.
The attack has consequently developed along two tracks. The first is restoration of the systems and administrative processes disrupted by containment. The second is the continuing security and privacy impact of information that has already left government control.
Credential remediation makes those tracks harder to separate. Disabling accounts, resetting passwords, revoking sessions, reviewing privileged access, and restricting applications can reduce the risk created by exposed authentication material, but each intervention may also delay the return of normal administrative services.
Cyber Insider reported on Berlin’s centralised response after the first stolen material was published. The response brings together affected Senate administrations, criminal investigators, information-security officials, and data-protection authorities as the city works through the consequences of the compromise.
The presence of credentials reinforces why an incident can remain active after investigators believe the original intrusion has been contained. Authentication material may provide opportunities for secondary access, while internal information can make subsequent phishing or impersonation attempts more convincing.
The problem is amplified in public administration, where accounts and documents may touch multiple agencies, contractors, citizen services, and specialist applications. A credential that appears minor in one system can have greater value if identities, passwords, or administrative relationships are reused elsewhere.
Berlin’s official statement does not establish that the leaked credentials have been successfully reused. It establishes that such material was contained in the new publication and that authorities considered the finding serious enough to strengthen existing security measures.
The continuing assessment will therefore need to establish which accounts were exposed, what privileges they carried, whether equivalent credentials existed elsewhere, and whether authentication logs show any suspicious use after the data was released.
Recovery from the original attack may be progressing, but the second publication has extended the incident beyond restoration. Berlin is now dealing with a persistent body of stolen information whose security consequences depend partly on what other systems trusted the identities and credentials inside it.
