Hackers exploited a single click to breach Berlin’s state network and leak files

Berlin faced a major cyber incident when a ransomware group exploited a single user interaction to gain access to the state network, demand a ransom and ultimately publish 1.4 million confidential files on the darknet after the senate refused to pay.

The attack, attributed to the ransomware group Rhysida, began when a user was directed to a website and asked to confirm they were human using a so called ClickFix interaction. On that site the user executed a key combination, pasted a command and pressed Enter, which allowed the attackers to penetrate the system.

Marco Di Filippo, cybersecurity expert at Whitelisthackers, noted that the incident combined a human error with excessive user privileges, and that the breach could have been prevented if the user lacked the rights needed to execute the command.

In the wake of the incident, the perpetrators demanded 30 bitcoin as ransom, an amount that the Berlin senate consistently refused to pay. The published files later appeared on the darknet.

Separately, attacks against cold stores disrupted refrigeration and rendered blood donations unusable because cooling was interrupted. Di Filippo highlighted that supermarkets’ internet connected fridges and other similarly networked devices are increasingly targeted once a vulnerability is discovered.

Di Filippo warned that the human factor remains central to most successful attacks, estimating that in around 80 to 95 percent of cases people enable exploitation of vulnerabilities. He argued that education and awareness are essential complements to technical measures.

Ethical hackers such as those at Whitelisthackers simulate criminal techniques to find vulnerabilities before attackers do. Their teams provide detailed reports to clients and coordinate with manufacturers to close discovered gaps, often leading to published CVE entries and collaboration with databases like the NVD and guidance from the Federal Office for Information Security.

Liberal News Analysis: What Does This Development Mean?

The incidents underline that social engineering combined with inappropriate user privileges can turn simple interactions into catastrophic breaches, leading to large scale data exposure and operational disruption. They also show that interconnected devices across sectors, from public administrations to supermarket refrigeration systems, magnify risk once attackers identify a weakness. The growing role of ethical hackers and mandatory regulations like NIS 2 reflect increased demand for proactive cybersecurity, while the repeated emphasis by experts on education indicates that technological fixes alone will not prevent many common exploits.

Quick Glance: What You Need to Know

• The Berlin state network breach occurred after a user executed a command on a website, allowing attackers access.
• The ransomware group Rhysida demanded 30 bitcoin and 1.4 million confidential files were later published on the darknet.
• Attacks on cold stores interrupted cooling and rendered blood donations unusable.
• Marco Di Filippo of Whitelisthackers highlighted human error and excessive privileges as key factors in the breach.
• Ethical hackers report vulnerabilities to manufacturers and help close gaps, often resulting in CVE disclosures and coordinated mitigation.
• Experts stress education and awareness alongside technical measures to reduce the human factor in cyberattacks.