[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK0fcffc7kMkhTiZsVflHrgY5Tjx26V3N1nrXFimTJdE":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e5ce5bc4-8a16-437c-bfaf-4dc76694385a","Berlin Won’t Pay Extortion Group Claiming Data Theft","berlin-won-t-pay-extortion-group-claiming-data-theft-a151f8","The Rhysida ransomware group has claimed the exfiltration of over 5TB of data, including personal information and credentials. The post Berlin Won’t Pay Extortion Group Claiming Data Theft appeared first on SecurityWeek.","Berlin has stated it will not pay a ransom to the Rhysida ransomware group, which claimed to have stolen over 5TB of data from the city's network. The data exfiltration occurred between August 7 and 12, impacting the Senate Department for Mobility, Transport, Climate Protection, and Environment. Investigations are ongoing, involving state and federal security agencies.","Berlin refuses to pay ransom to Rhysida group after 5TB data exfiltration.","https:\u002F\u002Fwww.securityweek.com\u002Fberlin-wont-pay-extortion-group-claiming-data-theft\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FBerlin.webp","2026-08-31T08:49:36+00:00","2026-08-31T10:00:11.814622+00:00",7,[17,20],{"name":18,"type":19},"Rhysida","threat_actor",{"name":21,"type":22},"Bitcoin","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[47],{"type":48,"value":18,"context":49},"malware","Ransomware group claiming responsibility for the attack.",[21],{"controls":52,"vendors":140},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":83,"name":84,"problem":85,"products":86},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":112,"name":113,"problem":114,"products":115},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":158},"berlin-refuses-rhysida-ransom-after-5tb-data-theft","Berlin Refuses Rhysida Ransom After 5TB Data Theft","The Rhysida ransomware group successfully exfiltrated over 5TB of data from Berlin's city network over a five-day window, targeting a sensitive government department responsible for mobility, transport, and climate protection. The multi-day exfiltration window — August 7 to 12 — suggests that detection and alerting mechanisms failed to identify abnormal data movement in time to prevent a significant breach. Ransomware groups like Rhysida increasingly use double-extortion tactics, stealing data before encrypting systems to maximize leverage against victims. While Berlin's refusal to pay is commendable policy, the incident highlights that public institutions remain high-value targets and must invest proactively in detection, segmentation, and data protection controls rather than relying on post-incident negotiations.",[146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST SP 800-61: Computer Security Incident Handling Guide","NIST SP 800-171: Protecting Controlled Unclassified Information","NIST IR-4: Incident Handling","NIST SI-4: Information System Monitoring","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach to the Supervisory Authority","GDPR Article 34: Communication of a Personal Data Breach to the Data Subject","ISO\u002FIEC 27001: A.16 Information Security Incident Management","MITRE ATT&CK: TA0010 - Exfiltration",{}]