The Certificate Was Valid

On Friday 4 September, at around 3.35 in the afternoon, an ultimatum ran out. About an hour later, according to heise online, the downloads began. Since then, files from Berlin's administration have been sitting on the dark web for anyone who wants them. The attackers put the number at about 1.44 million.

The group is called Rhysida. It had asked for 30 bitcoin, about two million euros at the time. The Senate, Berlin's state government, did not pay. “The State of Berlin will not be blackmailed,” said Governing Mayor Kai Wegner. That was the right call. It was also the end of the options.

I reconstructed the case from statements by the Senate, the state data protection commissioner and the federal cyber security agency BSI, from parliamentary papers, and from reporting by rbb, Tagesspiegel, heise and taz. Where only the attackers claim something, I say so. One question runs through all of it: how does a leak like this fit one of the most densely regulated IT landscapes in Germany?

Ten days off the network

How the attackers got in, the BSI explained in early September. According to heise, the agency confirmed that Rhysida used a trick it calls “TerminalFix”. A fake security check in the browser asks you to paste a command into the Windows terminal. The page has already put it on your clipboard. The Tagesspiegel reports that an employee of the transport department fell for it. This is not about blame. The trick is built to work on a normal working day.

What followed, as far as the authorities have confirmed it:

Ten days off the network, says the timeline. Inside the two departments that meant no outside email and no working from home (eGovernment/dpa). While the ultimatum ran, staff searched documents by hand to work out what was gone. That is the headline over the Tagesspiegel's reconstruction.

What is in the package

What exactly the files contain, the Senate has still not fully said. According to the Senate Chancellery, they are mostly unstructured data from shared and personal drives, not from specialist applications. Whether any individual is affected “can currently neither be ruled out nor conclusively confirmed”, the data protection commissioner writes (as of 11 September).

What newsrooms have seen, and what the attackers promise:

• Copies of ID cards and personal documents of staff. Among them, according to rbb, the ID card of the sitting transport senator and the emails of her two predecessors.
• According to the extortionists, as reported by dpa: more than 5,000 personnel files, fine proceedings, payroll records and confidential papers from committees of the Bundesrat, the federal upper house (heise/dpa).
• Emergency and protection plans for civil defence, and plans of critical sites from water and heating plants to substations (heise). The Tagesspiegel mentions lists of sites and facilities that need special protection in case of war.
• Files on the emergency drinking water supply. Jochim Selzer, a spokesman for the Chaos Computer Club, found names such as “emergency well” and defect reports on the state of extraction points (ZfK). Berlin's water utility says it has “taken precautions to increase our resilience”.
• Credentials. Rhysida had announced lists of passwords in plain text. The Tagesspiegel mentions a file called “Passwort.docx”.

The volumes do not agree, and that is part of the finding. Rhysida speaks of 5.79 terabytes. After the release the Tagesspiegel wrote of about 5.3 of the 5.8 terabytes, by mid-October of about four. The state has confirmed none of these figures.

The headlines went to the defence plans. The damage hit the rent first. With the disconnection, the system for housing benefit went down. For more than 50,000 eligible households the payment was at risk, and support for school children from low-income families was likely to stall too, the district of Pankow said. On 21 August, heise reported, payment was still not possible. Whether the end-of-August payment run went out on time, the authorities have not said publicly, as far as I can tell. netzpolitik.org writes that it was not paid on time.

And who is affected? A first analysis by the Tagesspiegel found data on at least 10,000 people, probably many more. By mid-October, the same report says, notification had only just begun. Even former transport senator Bettina Jarasch was told only informally that she was affected, according to rbb.

The certificate applied elsewhere

Now the part this piece is about. The obvious reading is: a certified environment was cracked. That is not quite true, and that is exactly the point.

First the rules. Under Berlin's information security guideline, every authority must build an ISMS, an information security management system that meets BSI standards. Since 2017 a statewide guideline has also obliged authorities to provide enough staff and money for protection, rbb reports. On top of that: the GDPR, rules for classified material, data protection and security officers, the court of audit.

Then the certificate. Berlin's IT service centre ITDZ has been certified by the BSI since autumn 2015. The current certificate, BSI-IGZ-0634-2024, dates from 1 August 2024 and is valid until 31 July 2027, on condition of yearly surveillance audits. It covers the ISMS, ITDZ's data centres and buildings, its workplace clients, telephony, “the networks and network technology for encrypted communication, in particular over the Berlin state network”, connections to outside networks and the private cloud. And it says of itself: “This certificate applies only to the stated object of examination.”

Then the place of the attack. Is ITDZ responsible for the IT of the affected departments? “In short: no,” says Borelli. Under Berlin's e-government law of 2016, authorities decide for their own specialist IT whether to use ITDZ or run their own. The Senate Department for Urban Development, Building and Housing, the building department for short, technically includes the transport department. “In most Berlin authorities that run their own IT, there is no central monitoring,” says Borelli. ITDZ's security operations centre runs around the clock, but for the central infrastructure.

So the outflow was noticed where the certificate applied: where the state network meets the internet. After a week. Inside the departments it looked different. The building department had introduced an attack detection system in 2026, it told rbb. The licences covered 5 per cent of its computers and servers; more was not possible “for financial reasons”. Neither the device the attackers came in through nor the servers the data left from were among them.

The certificate did not lie. It says exactly what a certificate can say: that on a given date, within a described scope, a process could be described and demonstrated. The attacker tests something else.

This is not an accusation against ITDZ. Its certificate says nothing about the file shares of a specialist department, and it never claims to. The problem is how we read it. We use an instrument that says something narrow, precisely, as the answer to the one question everyone asks: are we safe?

The auditor makes an appointment

An audit is a sample with a date. It has a scope, a preparation phase, a list of evidence and, at the end, a person who judges documents, not an attack in progress. Everyone knows when it starts. That is not fraud. That is the design.

The attacker has no appointment and no scope. He is not looking for the average level of security but for the weakest spot, and he only has to find it once. The defence has to be right everywhere, every day, in August too, in the department that was out of scope too.

This is well known and still not priced in. The certificate hides the asymmetry. It closes a question. It has an issue date, a frame on the wall, a binder and someone who can show it. It feels like a state. But an attack surface is not a state. It changes with every interface, every contractor, every change of staff.

A certificate says: on the reference date, the process could be described. An attack asks: did it hold on Tuesday at three? Both can be true. Only one of them hangs in the hallway.

Duty creates the loot

This is the point I like least, because more effort does not make it go away.

Proving that you are secure means writing down how. Network diagrams, role concepts, risk analyses, emergency and recovery plans, records of processing, contracts with access rules. Each of these documents makes sense. Each is also a map.

The emergency wells are a good example. They are part of Germany's drinking water provision for a crisis, governed by the federal Water Security Act. Whoever maintains them checks their condition and writes down defects, because a rule requires it, and the rule is sensible. Afterwards the report sits as a file in an administration, on the same network as housing benefit applications, protected like the minutes of a meeting. Selzer sees no acute danger to the water supply, but a medium-term risk: the data “cannot be collected back”.

The attacker does not need to analyse a system. He needs to find the file in which it was analysed. That file exists because a regulation demanded it.

The same goes for passwords in Office files. They do not come only from carelessness. They come from handovers, from people covering for each other, from changes of contractor, from the legitimate wish that work goes on when someone is ill. How common they are shows in an urgent motion by the Greens and the Left of 9 September. It calls for a task force to scan every file server for files such as “passwort.docx”, “passwörter.xlsx” or “logins.txt”.

A process that demands accountability produces documents. Documents can be copied. The more thorough the compliance, the richer the loot. The reflex after an incident like this, more documentation duties, is therefore partly a contribution to the next one.

Why nobody gets off

Because everyone is acting rationally. That is the uncomfortable part.

The auditor is paid for the attestation, the consultant for the concept. The head of department needs a paper for the court of audit, the data protection office and the committee. The leadership needs a sentence for the press conference. Everyone does their job, and every result has an invoice number, a date and an addressee.

The attack that does not happen has none of that. No document, no date, no receipt. Organisations pay for what they can see. Compliance is visible. Hardening would be effective. Count only the ink and you get ink.

Berlin has shown this in numbers. In 2024, according to the annual information security report that rbb has seen, funds for IT security were available only “partly to the required extent”. At the end of 2024, taz reports, the governing coalition cut ITDZ's budget from 32 to 18 million euros and took 2 million out of attack detection. The duty to run an ISMS stayed. What got cut was the view into the network.

An opponent without an address

Rhysida is not a state. The US agency CISA describes the group, active since 2023, as “ransomware as a service”: a business with affiliates who take a cut. This structure gave a German state a deadline, in a currency no central bank issues, and enforced the penalty on time. An outside provider cited by the BSI, as heise reports, counts that in 92 per cent of cases where such groups threaten to publish, they do.

Berlin had exactly two possible answers: pay or don't. The rule of law has many instruments. Almost all of them assume the other side has an address, an account, a court of jurisdiction or a reputation to lose. None of that applies here.

The state has stayed responsible for something it now only partly controls in technical terms. Regulation is the instrument it can be sure is its own. That is exactly why it gets overstretched.

The objections

So far this sounds like a reckoning with rules. This is where I would start to distrust the text. So, the objections.

Without baseline protection it would be worse. Probably true. IT-Grundschutz has raised the floor. And in the end the outflow was spotted exactly where things were certified and monitored around the clock. My claim is narrower: the floor is being sold as the ceiling. A passed audit shows that minimum requirements were met on the reference date. It does not show that an attacker will fail, and it is not meant to.

This is hindsight. Fair. After an incident everything looks negligent, and I know the situation on the ground only from statements and reports. That is why the yardstick has to be one you can name in advance. More on that below.

More monitoring is not free. Also true. The district of Lichtenberg, heise reports, refuses to install the software of the US vendor CrowdStrike, which the state now uses as a stopgap, on its servers. Its reasons: almost unlimited access to data, possible disruption of specialist applications, surveillance risks for staff. Attack detection is itself a way in.

So what would have helped? Not a sermon, a list. Keep less, because deleted data cannot leak. No credentials in documents, enforced technically rather than banned by policy. Separate networks, so one foothold does not open two departments. Treat compliance documents as what they are: the best summary of the target. And rehearse the outage, with a stopwatch, including how to pay housing benefit without the specialist system. None of this produces a certificate.

And NIS2? The EU directive brings two things with teeth: accountability of management, and deadlines. Article 23 requires an early warning within 24 hours of becoming aware of a significant incident. For the first time, a deadline measures not a description but a speed. For its own state administration, Berlin has to transpose the directive itself, and the Greens' and Left's motion explicitly demands that. I would not abolish NIS2. I would just stop confusing compliance with it for security.

Three clocks instead of a certificate

The word we use comes from a world with walls. Secure was a state you reach, have checked and then own. That is why a certificate fits it so well.

Berlin shows a different idea. Not a state but a speed. The questions that would have told us something are about time and reach. How long does someone copy data before anyone notices? Here at least seven days, from the first confirmed outflow to detection. How far does one foothold reach? Here across two departments, and 95 per cent of devices in the building department had no attack detection. How long until payments flow again? Ten days to get back on the network, 62 days until the emergency was declared over, and notifying the people affected is still going on.

Any organisation can measure these three numbers in advance, without an incident, without an auditor, without a certificate. They are uncomfortable because they close nothing. They stay bad for as long as they are bad.

Politics is moving that way, at least on paper. “There are structural deficits in IT,” digital state secretary Florian Hauer said back in August. Since mid-October, a service run by Deutsche Telekom, with CrowdStrike as a subcontractor, is meant to spot anomalies across the administration. In the election on 20 September, the Left became the largest party. The exploratory paper of the Left, the Greens and the SPD promises “mandatory attack detection for all agencies”. A few pages earlier, it says documentation duties should in principle be dropped wherever the law allows. The aim is less bureaucracy. It would also mean less loot.

The comfort of the old idea was that security is something you can finish. Losing that idea is the real loss, and it is not coming back. What can come back is honesty about scale. A group without an address forced two departments of a German state government off the network for ten days, and the numbers that mattered were in no audit report.

The certificate was valid. The data is gone. Both are true at once, and that is exactly the problem.

Sources and method

The timeline rests on official statements: press releases of the Senate Chancellery of 26 August and 5 and 6 September 2026, the guidance of Berlin's data protection commissioner (as of 11 September), Senate statements as reported by dpa, heise, eGovernment and the Tagesspiegel, and the interview with ITDZ chief executive Maria Borelli in Vitako (20 October). The BSI confirmed TerminalFix as the way in, heise reported on 7 September.

Durations are calendar days between documented dates: outflow from 7 to 12 August, six days. From 7 August to detection on 14 August, seven days, as a lower bound, because the first intrusion has not been published. From 14 to 24 August, ten days off the network. From 14 August to publication on 4 September, 21 days; to the end of the acute emergency response on 15 October, 62 days.

What is in the package rests on reviews by newsrooms (rbb, Tagesspiegel, ZfK with the CCC) and on the attackers' claims, both marked as such. No data volume is official. The 50,000 households for housing benefit come from the Tagesspiegel and dpa.

The scope and validity of the certificate are stated in certificate BSI-IGZ-0634-2024 itself. Operating responsibility under the e-government law and the lack of monitoring are Borelli's account. The 5 per cent coverage, the “financial reasons” and the fact that neither entry device nor servers were covered come from the building department in a statement to rbb (21 October). The cut from 32 to 18 million euros is reported by taz; I have not seen the budget papers myself.

I could not establish whether the two departments had a certificate of their own or a fully implemented ISMS. A freedom of information request on FragDenStaat about responsibilities and security checks is pending; the Senate Chancellery's deadline is 30 October. The investigations of the state criminal police and the public prosecutor are ongoing.

Text and research: Jonas Höttler. As of October 2026. The cover image and chapter images are concept images, AI-generated with Bria.