Investigation into cyberattack on Berlin's state network – perpetrators demand ransom

Background: Scale of the attack

Berlin's Governing Mayor Kai Wegner commented on the attack in front of the Senate Chancellery the day after the incident became known. He announced that the IT security of the administration would be fundamentally reviewed and that the affected systems would be restored step by step. In addition, it would be examined which data may have been compromised, Wegner said.

According to this, the IT specialists of the Berlin administration were working in crisis mode to isolate the affected networks and set them up anew. The Berlin State Criminal Police Office and the Federal Office for Information Security are also involved, according to the Senate Chancellery, to analyze the attack vectors and secure evidence pointing to the perpetrators.

State Secretary for the Interior Florian Hauer pointed out that the processing of the incident would take time. It would be necessary to carefully examine which areas of the administration were affected and one must not act prematurely. Citizens would have to prepare for potentially longer processing times for certain services.

Reactions from politics and administration

Criticism of past crisis management came from Berlin politics. Senator for the Interior Iris Spranger defended the steps taken so far and referred to the ongoing investigations. The CDU-led Senate Chancellery announced that, once the criminal investigations were completed, the matter would also be reviewed organizationally and politically.

Security experts assess the incident as further evidence of the vulnerability of public IT infrastructures. Comparable attacks have occurred in other federal states and municipalities in recent years. The incidents show that administrations need to significantly strengthen their resilience against cyberattacks.

Investigations and consequences for citizens

According to its own statements, the Berlin Public Prosecutor's Office is examining several possible criminal offenses, including computer sabotage and attempted extortion. Whether any suspects have already been identified was not disclosed, with reference to the ongoing proceedings. Further information is to follow as soon as it is tactically justifiable for the investigation.

Parallel to the investigations, the Senate Chancellery set up a telephone hotline and an information page on the internet, through which citizens can find out about the current status and possible effects on administrative services. The authorities called on people to report suspicious emails or indications of possible data leaks directly.

How long the full restoration of the affected systems will take remained unclear in the evening. Kai Wegner emphasized that the security of the data of Berlin's residents was the top priority. No compromises would be made that would weaken the integrity of the administration.

The investigators assume that the perpetrator or perpetrators acted professionally and had in-depth knowledge of the attacked systems. According to initial findings, a political motive could not be ruled out, but also could not be confirmed. The Public Prosecutor's Office announced that it would provide timely information when corresponding investigation results were available.