Rhysida claims 5.79TB exfiltration from Berlin state network via unpatched VPN and Zerologon paths

Berlin's Senate Chancellery confirmed the extortion attempt and additional data loss from the Senate Department for Mobility, Transport, Climate Protection and Environment. The department detected the first outflow on August 7 but remained connected until August 14. No ransom amount or victim guidance has been released. The attackers listed 1.44 million files, dominated by 124,823 maps and geodata entries. CISA, FBI, and MS-ISAC advisory from November 2023 documents Rhysida's reliance on valid VPN accounts without MFA, Zerologon (CVE-2020-1472), and phishing. Berlin's response names no actor while Der Spiegel and the leak site both attribute the incident to Rhysida. This matches the group's pattern of double extortion seen in Stuttgart city and Welthungerhilfe incidents earlier in 2026. Nine German victims appear among Rhysida's 280 total listings. The Senate's refusal to pay aligns with CISA guidance but leaves 12,076 individuals without notification. Geodata holdings raise risks of secondary targeting against transport and environmental infrastructure. Network segmentation failures allowed lateral movement across departments. Investigators from state police, prosecutors, and federal agencies continue attribution work. Additional leaks remain possible if the group follows its established timeline of sample releases within two weeks of listing.