CyberSecurity News

Berlin investigates new data leak after hackers publish stolen login credentials

The Record

· September 7, 2026

AI summary

Berlin authorities are investigating a new data leak after hackers published stolen login credentials online. The leak is the latest incident involving the city's government data. Germany's information security agency has also issued a warning about the Rhysida cybercrime group, although it is unclear if they are directly linked to the data leak. The agency's warning suggests that Rhysida may be a threat to be aware of. Berlin's government has been affected by a data leak for the second time. The leak has resulted in sensitive information being made publicly available.

Threat groups mentioned

rhysida

281 victims

active since 2023

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files. Source: https://github.com/crocodyli/ThreatActors-TTPs

Countries in focus

🇩🇪Germany1,078 RW · 182 crit

Read the full article at The Recordtherecord.media/germany-berlin-second-data-breach-city-agencies

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Record.