INSIGHTS HUB

CyberCase 360 | Berlin vs. Rhysida: NIS2 Gap Exposed

September 9, 2026

September 9, 2026

The Rhysida ransomware attack on Berlin exposed a seven-day gap between data exfiltration and network isolation, followed by the publication of stolen government data after Berlin refused to pay the ransom. The incident highlights critical weaknesses in detection, segmentation, MFA and incident response — and shows why public-sector organisations outside the mandatory NIS2 scope should adopt equivalent security controls voluntarily.

Berlin Refuses to Pay: Rhysida Leaks State-Network Data After a Seven-Day Gap Between Exfiltration and Isolation

What Happened

1. Between August 7 and August 12, 2026, data was exfiltrated from the Berliner Landesnetz, according to the Senate Chancellery’s forensic timeline; the Senate Department for Mobility, Transport, Climate Protection and Environment first reported an outflow on August 7 (The Hacker News, Aug 31; SecurityWeek, Aug 31, 2026).

2. On August 14, Berlin disconnected the Senate Departments for Urban Development, Building and Housing and for Mobility, Transport, Climate Protection and Environment from the state network to contain the intrusion; both remained isolated for approximately one week (dpa via 20 Minuten, Sep 5, 2026).

3. On August 28, the Rhysida ransomware group listed Berlin on its dark-web leak site, claiming 5.79 TB of data across roughly 1.44 million files, and opened a seven-day auction with a 30-bitcoin minimum bid; the same day, Mayor Kai Wegner and Interior Senator Iris Spranger confirmed the extortion attempt and stated that Berlin would not pay (The Record, Aug 28; Help Net Security, Sep 1, 2026).

4. Berlin confirmed that personal or other non-public data of citizens, state employees and companies could not be ruled out from the stolen material, and stated that risk-based notifications would be issued under the GDPR once analysis identified affected parties; the State Criminal Police Office (LKA), the public prosecutor and federal security agencies are investigating (t-online / Land Berlin press office, Sep 3; Help Net Security, Sep 1, 2026).

5. On September 4, after the deadline passed, Rhysida published the dataset; the Senate Chancellery confirmed that contracted IT forensic specialists were examining the released files. Berlin has not verified the attackers’ claims about volume or contents (dpa via 20 Minuten, Sep 5; Borncity, Sep 4, 2026).

Business Impact

[CONFIRMED] Two Senate departments were isolated from the Landesnetz on August 14 for roughly one week; housing-benefit (Wohngeld) applications and payments were unavailable for days (dpa via 20 Minuten, Sep 5, 2026).

[CONFIRMED] Berlin confirmed a data theft and an extortion demand, refused payment, and the attackers published the stolen data on September 4, 2026 (Mayor Wegner / Senate Chancellery via Help Net Security, Sep 1; dpa via 20 Minuten, Sep 5, 2026).

[CONFIRMED] Personal data of citizens, state employees and companies that interacted with the affected departments may be among the stolen material; Berlin has committed to GDPR risk-based notifications and advised affected persons to file criminal complaints (Land Berlin press office via t-online, Sep 3, 2026).

[CONFIRMED] Berlin officials have stated that election systems were not affected; the Berlin state election is scheduled for September 20, 2026 (Berlin Senate statements as reported by Tech-Insider, Sep 1; Wikipedia election page, 2026).

[ESTIMATED] 5.79 TB of data across ~1.44 million files, including 46,500 contracts, personnel and payroll records, passwords, health data and vulnerability analyses relating to drinking-water supply — attacker-claimed (Rhysida leak-site listing, Aug 28, as reported by The Record and SecurityWeek); not verified by Berlin. Ransom demand of 30 BTC, valued by Berlin authorities at approximately €2 million (Land Berlin press office via t-online, Sep 3, 2026).

[ESTIMATED] Financial cost of the incident and number of affected data subjects: not publicly disclosed. Rhysida claims 5,941 passwords and 2,738 health records in the dataset (single-source, Denkstrom, Sep 4, 2026; unconfirmed by Berlin).

Likely Root Cause

▸ Initial access vector has not been disclosed by Berlin. Rhysida affiliates are documented as gaining entry through external-facing remote services such as VPNs without multi-factor authentication, phishing, and exploitation of Zerologon (CVE-2020-1472), then moving laterally with living-off-the-land tools (PsExec, PowerShell, RDP).
Source: CISA / FBI / MS-ISAC advisory AA23-319A on Rhysida ransomware, November 2023; vector for Berlin: [UNRESOLVED]

▸ A seven-day gap between the first reported data outflow (August 7) and network isolation (August 14) allowed the exfiltration window (August 7–12) to run to completion. Public reporting differs on whether August 7 was a detection event or a retrospectively dated forensic finding.
Source: The Hacker News, Aug 31; SecurityWeek, Aug 31, 2026 — [UNRESOLVED] detection date

▸ Multi-terabyte exfiltration (if the attackers’ volume claim is even approximately correct) over five days without automated egress alerting indicates no effective outbound-traffic baselining or data-loss detection on the Landesnetz perimeter.
Assessed from the exfiltration timeline and attacker-claimed volume; Berlin has not published traffic data

▸ The Landesnetz is a shared network across Senate departments; a single intrusion reached at least two departments’ environments, suggesting limited segmentation between administrative units.
Assessed from the scope of the August 14 isolation (two departments disconnected), dpa via 20 Minuten, Sep 5, 2026

▸ The Länder are outside the public-administration scope of Germany’s NIS2 implementation act (NIS2UmsuCG, in force 6 December 2025), which primarily covers the federal administration. No equivalent binding baseline with 24h/72h reporting, management-body accountability and audited risk-management measures applied to the Berlin Landesverwaltung.
Source: Freshfields, Dec 7, 2025; OpenKRITIS, 2026 — regulatory-scope assessment

Control Failures

[CF-1] 📋 PROCESS Detection-to-containment gap of seven days. Whether the August 7 outflow was observed in real time or reconstructed later, the affected department was not isolated until August 14 — the full exfiltration window elapsed before a containment decision was executed.

[CF-2] ⚙️ TECHNOLOGY No effective outbound-traffic anomaly detection or data-loss prevention at the network edge. Sustained bulk exfiltration over five days did not trigger automated containment.

[CF-3] 🪪 IDENTITY Remote-access and administrative authentication not hardened against Rhysida’s documented playbook (VPN without MFA, credential reuse, Zerologon, lateral movement via RDP/PsExec). The attackers claim the dataset contains plaintext credentials — attacker-claimed, unverified — which, if true, points to unmanaged credential storage inside the network.

[CF-4] 📋 PROCESS No binding NIS2-equivalent governance regime for the Land administration: no statutory 24h/72h reporting clock, no management-body accountability for risk-management measures, and no audited baseline — the Landesnetz was governed by the spirit of NIS2, not its obligations.

[CF-5] 👥 PEOPLE Public-sector staff remain the most likely entry point for Rhysida-style intrusions (phishing and credential theft per CISA AA23-319A). Post-leak, employees and citizens whose data was published now face targeted follow-on phishing using authentic internal documents.

Recommendations

↳ CF-1 Pre-authorise a network-segment isolation playbook with a four-hour execution ceiling (NIST SP 800-61 Rev. 3 — Containment; BSI IT-Grundschutz DER.2.1 — Behandlung von Sicherheitsvorfällen; ISO 27001:2022 Annex A 5.26)
Define in advance which indicators (confirmed outbound transfer to an unknown destination, ransomware-family tooling, credential-dumping alerts) authorise the IT security officer to disconnect a department or VLAN from the Landesnetz without waiting for political sign-off. Set a four-hour ceiling from confirmed indicator to isolation, rehearse it in a quarterly tabletop with the Senate Chancellery and ITDZ Berlin, and log every exercise as NIS2 Art. 21(2)(b)-style evidence.

↳ CF-2 Deploy per-segment egress baselining with automatic block on sustained deviation (CIS Controls v8.1 — 13.3 (centralised network traffic analysis), 13.6 (network traffic flow logs); ISO 27001:2022 Annex A 8.16 (monitoring), A 8.12 (data leakage prevention))
Export NetFlow/IPFIX from every Landesnetz core and perimeter device to the SIEM and retain 90 days. Baseline outbound bytes per server VLAN over 30 days; alert at 300% of baseline sustained for 60 minutes and auto-block at 500%. Deny direct outbound from server and file-share VLANs to non-allowlisted internet destinations; force all outbound through an inspecting proxy with TLS inspection where legally permissible. Terabyte-scale outflow over five days should be structurally impossible without a human being paged.

↳ CF-3 Close Rhysida’s documented entry and lateral-movement paths (NIS2 Art. 21(2)(j) — MFA and secured communications; BSIG (as amended by NIS2UmsuCG) § 30(2) Nr. 10; NIST SP 800-53 Rev. 5 IA-2(1), AC-17; CISA AA23-319A mitigations)
Enforce phishing-resistant MFA (FIDO2/WebAuthn or certificate-based smart cards already issued to Berlin staff) on every VPN, RDP gateway and administrative interface — no exceptions for service or vendor accounts. Confirm Netlogon secure-channel enforcement for CVE-2020-1472 on all domain controllers. Block PsExec-style remote service creation via AppLocker or WDAC on servers, and disable NTLM authentication where legacy dependencies allow. Move every stored credential into a vault; rotate all Landesnetz service-account and administrative credentials now, on the assumption that the attackers’ plaintext-password claim is true.

↳ CF-4 Adopt the NIS2UmsuCG § 30 measures catalogue as binding for the Berlin Landesverwaltung by state law or Senate resolution (NIS2 Art. 2(5)(b) — Member State discretion over regional public administration; Art. 20 (management-body accountability); Art. 21 (risk-management measures); Art. 23 (24h/72h reporting); BSI Standard 200-2 (IT-Grundschutz methodology))
Berlin is not obliged by NIS2 — that is precisely why it should bind itself. Enact the ten measure categories of BSIG § 30(2) for the Landesverwaltung, designate the state CERT (Berlin-CERT / ITDZ) as recipient of 24-hour early warnings, require IT-Grundschutz Standard-Absicherung certification for the Landesnetz core and every Senate department within 24 months, and assign personal accountability for the measures to State Secretaries, mirroring NIS2 Art. 20. Publish an annual readiness statement to the Abgeordnetenhaus.

↳ CF-5 Run a post-leak targeted-phishing programme and deliver the 5B rules below as a standing briefing (NIS2 Art. 21(2)(g) — cyber hygiene and training; ISO 27001:2022 Annex A 6.3 (awareness); CIS Controls v8.1 — 14.2, 14.6)
Within 30 days, run a phishing simulation across all Senate departments that uses the exact pretexts the published data enables — payroll queries, contract amendments, housing-benefit case references — and measure click and report rates per department. Brief every employee on what was published and what a follow-on attack will look like. Deliver the user-facing rules in 5B as a standing briefing to all state employees and, in adapted form, to citizens through the Wohngeld and Bürgeramt channels.

Regulatory Relevance

NIS2 (EU) 2022/2555 Art. 2(5)(b) — regional public administration at Member State discretion; Art. 20 (governance); Art. 21(2)(b), (g), (j); Art. 23 (24h / 72h reporting)
NIS2 lists public administration as an Annex I sector but makes coverage of regional entities optional (Art. 2(5)(b)). Germany’s transposition, the NIS2UmsuCG in force since 6 December 2025, scopes public administration primarily to the federal level, so the Berlin Landesverwaltung is not a regulated entity. Every substantive failure in this case — incident handling (21(2)(b)), training (21(2)(g)), MFA (21(2)(j)), and no statutory reporting clock (Art. 23) — maps to an obligation Berlin was not legally bound by. That is the intersection to flag: NIS2 readiness in German public administration currently stops at the federal boundary.

Germany — NIS2UmsuCG / BSIG Gesetz zur Umsetzung der NIS-2-Richtlinie (BGBl. 2025 I Nr. 301, in force 6 Dec 2025); BSIG § 28 (scope), § 30 (risk-management measures), § 32 (reporting)
The revised BSI Act carries the NIS2 measures catalogue and reporting duties for roughly 29,500 entities, but Land and municipal administrations are largely excluded, with a future KRITIS-Dachgesetz expected to address parts of that gap. Berlin can voluntarily bind itself to § 30 and § 32 by state law — the recommendation in CF-4. [KB UPDATE NEEDED] regulations-reference.md §2.3 still lists IT-Sicherheitsgesetz 2.0; the NIS2UmsuCG has superseded it.

GDPR (EU) 2016/679 Art. 32 (security of processing); Art. 33 (72-hour notification to the supervisory authority); Art. 34 (communication to data subjects); Art. 4(7) controller — each Senate department
Each affected Senate department is a controller. The 72-hour Art. 33 clock to the Berlin Commissioner for Data Protection (BlnBDI) ran from awareness of the breach in mid-August; Berlin has confirmed it will issue Art. 34 notifications on a risk-based basis. Publication of the data on September 4 materially raises the ‘high risk’ assessment under Art. 34(1) for anyone whose ID, bank or health data is confirmed in the dump. The attackers themselves cite GDPR exposure as leverage — a pattern now standard in extortion of European public bodies.

Berlin — BlnDSG Berliner Datenschutzgesetz (state data-protection act implementing GDPR for Berlin public bodies); supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
State-level implementation governs the public-sector specifics of GDPR compliance for Berlin authorities, including the BlnBDI’s investigative and corrective powers over Senate departments. [KB UPDATE NEEDED] BlnDSG and the BlnBDI are not in regulations-reference.md; add under §2 as the competent Land-level regime.

BSI IT-Grundschutz BSI Standards 200-1/200-2/200-3; Kompendium modules DER.1 (Detektion), DER.2.1 (Vorfallbehandlung), ORP.4 (Identitäts- und Berechtigungsmanagement), NET.1.1 (Netzarchitektur), OPS.1.1.5 (Protokollierung)
IT-Grundschutz is the de facto security baseline for German public administration and the reference against which a Land network’s maturity will be judged politically, even absent statutory force. Detection (DER.1), incident handling (DER.2.1), network segmentation (NET.1.1) and logging (OPS.1.1.5) are the modules directly engaged. [KB UPDATE NEEDED] IT-Grundschutz is not in regulations-reference.md; add under §2.3.

ISO/IEC 27001:2022 Annex A 5.24–5.26 (incident management planning, assessment, response); A 8.16 (monitoring); A 8.12 (data leakage prevention); A 8.5 (secure authentication); A 8.22 (segregation of networks)
Seven days from outflow to isolation is a direct nonconformity against A 5.26 (response) and A 8.16 (monitoring); undetected bulk exfiltration against A 8.12; shared-network blast radius against A 8.22. These are the clauses an ISMS auditor would open first.

NIST SP 800-61 Rev. 3 / CIS Controls v8.1 SP 800-61r3 — Detection & Analysis, Containment; CIS Control 13 (network monitoring and defense), Control 17 (incident response management), Safeguards 13.3, 13.6, 17.4, 17.6
The operative failure was time-to-contain. CIS 17.4 (establish and maintain an incident response process) and 17.6 (define mechanisms for communicating during incident response) address exactly the decision path that should have isolated a department on day one rather than day seven.

ISO 22301:2019 Clause 8.2 (business impact analysis), 8.4 (business continuity plans and procedures)
Housing-benefit processing stopped for days because the department that runs it was disconnected. A BIA that classifies Wohngeld as a citizen-critical service would have required an isolated fallback workflow, so that containment of one network does not equal suspension of a social benefit.

How SEG Can Help

↳ CF-1 / CF-4

💡 vCISO

SEG’s virtual CISO service builds the governance layer Berlin lacked: a NIS2-equivalent measures baseline adopted as internal policy, a pre-authorised isolation playbook with defined decision rights, a 24h/72h reporting workflow, and the management-level accountability that turns ‘in the spirit of NIS2’ into audited practice — for public bodies outside statutory scope as much as for regulated entities.

↳ CF-2 / CF-3

💡 Penetration Testing & Vulnerability Management

SEG replays the Rhysida playbook against your environment — MFA-less remote services, Zerologon exposure, credential reuse, lateral movement via RDP and PsExec — and then tests whether a simulated multi-gigabyte exfiltration actually triggers your egress controls. The finding that matters is not the entry point; it is how long the outflow ran before anyone was alerted.

↳ CF-4

💡 Third-Party Risk Assessment

Shared state networks are supplier ecosystems: a central IT service provider, department-level administrators, and outsourced application operators. SEG assesses each party’s access, segmentation and incident obligations so that one department’s compromise is contained by design rather than by emergency disconnection.

↳ CF-5

💡 Security Awareness Training

SEG delivers post-breach awareness programmes built on the specific pretexts a leak enables — authentic contracts, payroll and case references — including the 5B one-pager above, adapted to your organisation, and phishing simulations that measure report rates rather than just click rates.

🎯 Strategic Signal

The Berlin case is a preview of the next phase of European public-sector cyber regulation. NIS2 set the standard, but Member States were allowed to leave regional and local administration outside it — and Germany did. Ransomware groups do not read jurisdictional carve-outs; they read network diagrams. Every Land, region, autonomous community and municipality that holds payroll, identity and infrastructure data is now the soft interior of Europe’s public sector, and the gap between what NIS2 requires of a federal ministry and what binds a state capital is the gap Rhysida walked through. Expect the political pressure after Berlin to close it — and expect the organisations that closed it voluntarily to be the ones that are not in next year’s briefing.

💬 SEG Expert View — Volodymyr Lytvyn, vCISO / GRC Manager

We hear one sentence from public-sector clients more than any other: ‘NIS2 does not apply to us.’ Berlin shows what that sentence costs. The city did nothing legally wrong — it was not a regulated entity, it had no 24-hour reporting clock, and no management body was personally accountable for its risk-management measures. And that is exactly why a department kept moving data to criminals for a week before anyone was authorised to pull the cable.

Our advice to any public body outside statutory scope is simple: bind yourselves anyway. Take the measures catalogue of NIS2 Article 21 — or, in Germany, BSIG § 30 — and adopt it as internal policy with a named accountable owner per department. Pre-authorise containment so that the decision to isolate a network is a technical trigger, not a political meeting. Treat the GDPR 72-hour notification clock as a planning constraint, not a post-incident scramble.

Berlin’s refusal to pay was the right call, and the Chaos Computer Club and the BSI both said so. But refusing to pay only works if you can also refuse to be surprised. Governance is what buys you that — and it does not require a regulator to make you do it.