Systemic Failures in German Public Sector Cybersecurity

• A major cyberattack on Berlin Senate administrations has exposed critical vulnerabilities and systemic neglect in public sector information security.
• Attackers exfiltrated approximately one million records after gaining undetected access to state networks, highlighting long-standing issues with outdated software and chronic underinvestment in IT infrastructure.
• While officials initially attempted to shift blame onto individual employees, systemic failures—including hardcoded passwords and unpatched legacy systems—are the primary drivers of the breach.

The Berlin Data Breach

• Detected in mid-August, the intrusion led to the disconnection of several government departments, causing significant delays in citizen services, including welfare payouts for 50,000 households.
• The ransomware group Rhysida demanded 30 Bitcoin for the stolen data; Berlin authorities refused the ransom, leading to the full publication of the data on the dark web in early September.
• Investigations into the scope of the leak are ongoing and expected to last for weeks.

Underlying Structural Weaknesses

• Decades of budget cuts, lack of prioritization, and technical debt have created an unmanageable "zoo" of legacy applications.
• 21 critical administrative systems currently use hardcoded passwords that cannot be changed, rendering them inherently insecure.
• Communication between the central IT service provider (ITDZ) and the Senate has been described as "completely broken," preventing effective monitoring and incident response.

The Paradox of Security Policy

• Government policy increasingly prioritizes offensive cyber capabilities and expanded surveillance powers for intelligence services over the basic hardening of public infrastructure.
• The current approach is described as "locking the front door while leaving the patio door wide open," a stance that fails to protect citizens, businesses, and critical infrastructure.