Leaked files contains identity documents, payslips and employment references among other personal data.

Cybercriminals claiming to be from a group called ‘Rhysida’ leaked nearly 6TB of sensitive data from the Berlin state administration after hacking the government department late last month. The attack comes just weeks before Berlin is set to conduct state elections.

Rhysida claimed responsibility for the attack on its leak site on August 28, posting an entry titled ‘Berlin, Germany’, which contained nearly 1.5m files – sized 5.79TB, including personal information on more than 12,000 individuals.

The data was leaked last Friday (4 September) after the German state refused to pay a 30 bitcoin ransom, equivalent to around €2m.

The Berlin Senate Chancellery and security authorities said they are conducting a thorough review of the data following the leak on Friday.

“IT forensic experts working on behalf of the State of Berlin are working around the clock to examine the published data. Appropriate measures will be taken based on the findings,” an official statement from the Senate Chancellery said. Affected individuals will be notified on a risk-based basis, it added.

Citizens who, independently of this, become aware “that their data has been published or is being used for criminal offenses such as fraud or identity theft should file a criminal complaint,” the statement read.

The leaked files reportedly contain scanned identity documents, payslips, employment references and contract documents, as well as sensitive data on critical infrastructure. Rhysida is already sharing lists of filenames on social media, according to news publications.

Meanwhile, Hamburg-based investigative journalist and weapons expert Lars Winkelsdorf said that the leaked files contain plans concerning national defence “ranging from the federal government’s secret communication channels in the event of an apocalypse to defence-related companies and emergency plans developed by government agencies”.

Last month, France disclosed a cyberattack on its tax authority in June and July that resulted in the theft of tax data belonging to around 678,000 French individuals and businesses.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.