A series of cyber-attacks attributed to the Rhysida hacking group has exposed serious weaknesses in the digital infrastructure of Berlin’s public sector, with confidential data reportedly taken from local authorities and critical infrastructure sites.
The attacks, reported on 9 September 2026 by United24Media, have raised concerns that compromised systems in the German capital may have significant network connections to other parts of the federal government. German sources suspect links between the attackers and Russia, although that connection has not been publicly established as a fact.
The breach highlights how outdated and fragmented technology can leave government networks exposed to sustained cyber operations. It also underlines the wider risk facing Germany as Russian state-linked services and affiliated hacking groups seek weaknesses in European digital systems for intelligence gathering, disruption and preparation for more damaging attacks.
Outdated systems opened the way
Cybersecurity specialists believe the attackers exploited a patchwork of ageing infrastructure across Berlin’s public administration. In some departments, responsibility for cybersecurity reportedly rests with employees who are not IT specialists. Servers are housed in inadequately protected premises, while a substantial share of internal traffic consists of unencrypted Word documents.
That combination creates multiple opportunities for an intrusion to spread once an attacker has gained an initial foothold. The suspected first point of access was the email accounts of district administrations in Mitte and Neukölln, two Berlin districts. The main penetration, however, is believed to have been carried out through the Senate administration responsible for environmental affairs.
The distinction matters because an attack that begins in a district office can become far more serious if it reaches systems with broader administrative connections. The stolen information reportedly came not only from local government bodies but also from sites classed as critical infrastructure, increasing the potential consequences beyond the loss of routine administrative data.
Warning of wider connections
Max Kilger, a cybersecurity expert, warned that there could be “significant network connections” between the systems compromised in Berlin and other systems belonging to Germany’s federal government. The warning does not establish that federal networks were breached, but it points to the central difficulty in assessing the incident: the immediate attack may be narrower than the access available to those who carried it out.
Weak segmentation between networks can allow stolen credentials or malicious tools to be used beyond the system first targeted. In Berlin’s case, the combination of district email accounts, a Senate administration and exposed internal documents illustrates how a fragmented public-sector structure can produce a larger security risk than any single technical flaw.
The attack also demonstrates why the protection of digital infrastructure cannot be treated as a specialist concern confined to IT departments. Inadequate server security, unencrypted communication and responsibility assigned to staff without the necessary expertise can turn ordinary administrative systems into entry points for hostile operations.
Germany’s wider security challenge
Germany is under pressure to close vulnerabilities in the IT systems of public institutions and critical infrastructure, and to improve the mechanisms used to detect and contain intrusions. The concern is particularly acute because Berlin’s support for Ukraine and its firm sanctions policy towards Russia make the country a priority target for Russian cyber operations, according to the assessment accompanying the incident.
For Moscow’s security services and hacking groups connected to them, gaps such as those exposed in Berlin offer more than an opportunity to steal confidential information. They can provide access to networks, reveal how public bodies operate and create the conditions for a more disruptive operation at a later stage. Cyber activity therefore functions as an instrument of hybrid pressure, capable of imposing costs without the clear public threshold associated with a conventional attack.
The immediate priority is to establish how far the attackers moved through Berlin’s systems and whether any link to federal networks was used. Until that is clear, the incident remains both a data breach and a warning about the resilience of Germany’s national digital infrastructure.
How should Germany prioritise its response: by rapidly modernising vulnerable local networks or by concentrating first on protecting their connections to national systems?
