TL;DR: Unosecur’s analysis shows Rhysida’s breach of Berlin’s state government network showed that segmentation, VPN access, and standard authentication did not answer the key question of what a compromised account could reach across departments, leaving 5.79 terabytes and nearly 6,000 credential files exposed. The breach shows that runtime authorization mapping, not perimeter control, determines blast radius in large identity-heavy environments.
At a glance
What this is: This is a breach analysis of Berlin’s ransomware incident, which exposed a gap between authentication controls and the real blast radius of a compromised account.
Why it matters: It matters because IAM, NHI governance, and PAM teams need a way to map what identities can actually reach at runtime, not just whether they can sign in.
By the numbers:
- Rhysida claimed 5.79 terabytes across 1.44 million files.
- Berlin’s leak also included nearly 6,000 files containing login credentials.
👉 Read Unosecur’s analysis of the Berlin ransomware breach and account blast radius
Context
A compromised account can be more dangerous than a network breach when nobody can say what that account is allowed to reach. Berlin’s case is a classic identity governance failure because the security stack controlled access at the perimeter but did not define the full runtime blast radius of an already-authenticated identity.
For large public-sector networks, the issue is not whether VPNs, MFA, or segmentation exist. The issue is whether the organisation can answer, quickly and accurately, which systems, credentials, and departments an account can touch once it is inside the environment.
Berlin’s incident is therefore useful as a governance test, not just a ransomware story. It shows how access relationships across departments become the hidden risk surface when identity maps are incomplete.
Key questions
Q: What fails when a ransomware team can authenticate users but cannot map their blast radius?
A: Containment fails because the organisation can block network paths without knowing which systems a compromised identity can still reach. That leaves responders reconstructing entitlement scope after the fact, which slows isolation and increases the chance of lateral movement. The real gap is not login control, but reachability control across departments, shared accounts, and inherited permissions.
Q: Why do standing privileges make ransomware incidents harder to contain?
A: Standing privileges give an attacker more authority after the first login, which shortens the time needed to move from access to disruption. When admin rights, service accounts, or vendor entitlements remain broadly usable, a single compromise can affect multiple systems before response teams can narrow the blast radius.
Q: What signs show that blast-radius governance is not working?
A: The warning signs are slow containment decisions, manual access reconstruction, unclear ownership of shared accounts, and uncertainty about which systems a department can actually touch. If responders must build the reach map after an incident starts, the control is not functioning as a live governance mechanism. It only exists on paper.
Q: Who should own the answer to what an account can reach across the enterprise?
A: Ownership should sit with identity governance and platform teams together, because the question spans entitlements, shared credentials, and operational dependencies. Security operations can execute containment, but they should not be the only group able to answer scope. Boards and public-sector leaders should require a defensible reach map as a resilience control, not an audit artifact.
Technical breakdown
Why segmentation did not stop the spread
Network segmentation limits which parts of a network can talk to each other, but it does not define what an authenticated identity can do inside those boundaries. In Berlin’s case, the controls in place governed entry and network partitioning, yet they did not resolve inherited permissions, shared credentials, or cross-department access. That is why segmentation can slow lateral movement without eliminating the actual blast radius of a compromised account. The technical gap is between transport control and entitlement control. Practical implication: map account reach across systems, not just segment connectivity.
Practical implication: map account reach across systems, not just segment connectivity.
Runtime authorization is the missing control plane
Authentication proves that an identity is allowed to log in. Authorization determines what that identity can touch after login, and runtime authorization is the live state of those permissions as systems and roles change. Berlin’s breach shows why boards get incomplete answers from perimeter controls: those controls do not model standing privilege, inherited access, or departmental overlap. When identity governance lacks a current access graph, responders have to reconstruct blast radius after the fact. Practical implication: maintain a live authorization map that links identities to reachable assets and delegated access.
Practical implication: maintain a live authorization map that links identities to reachable assets and delegated access.
Shared credentials turn one compromise into many doors
Shared credentials and cross-department accounts create a collapse in scoping because the compromise of one login can expose multiple operational domains at once. The article notes nearly 6,000 credential files among the exfiltrated material, which suggests a wider trust problem than a single user breach. In NHI terms, the issue is not just secret exposure, but secret reuse and overextended access paths that make containment ambiguous. Practical implication: correlate every shared or service credential to an owner, purpose, and reachable asset set.
Practical implication: correlate every shared or service credential to an owner, purpose, and reachable asset set.
Threat narrative
Attacker objective: The objective was to force payment by demonstrating that one compromised identity could expose a wide portion of Berlin’s government network and sensitive records.
- Rhysida gained access to Berlin’s state network through a compromised department that remained connected to the shared backbone after the initial intrusion.
- The attacker then used valid access and unresolved entitlement scope to move across connected systems instead of encountering an immediate authorization boundary.
- The campaign escalated into large-scale exfiltration, including 5.79 terabytes of files and nearly 6,000 credential files, before the leak site disclosure.
- The objective was to maximize pressure for ransom by proving broad reach across government departments and sensitive infrastructure data.
Breaches seen in the wild
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
- Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Account blast radius is the governance gap this breach exposed. Berlin had the controls most enterprises recognise, including VPN access, MFA, and segmentation, but those controls do not answer what an authenticated identity can reach after login. The breach worked because the organisation could not translate access into an exact, current reach map across departments. That is not a perimeter failure, it is a blast-radius failure, and practitioners should treat it as an identity governance problem first.
Standing privilege becomes a breach multiplier when cross-department access is undocumented. A compromised account is only as contained as the weakest entitlement relationship attached to it. Berlin’s case shows that inherited permissions and shared credentials can extend far beyond the segment boundary that security teams think they are defending. The practitioner lesson is that blast radius must be computed from effective access, not from network location or organisational chart assumptions.
Runtime authorization, not authentication, determines whether containment is possible. Authentication answers who is in the door. It does not answer what that identity can touch while active, or whether the same login is reused elsewhere with broader reach. Berlin’s breach shows why incident teams need a standing entitlement graph before a crisis, not a manual reconstruction after exfiltration begins. That is the control plane large networks still lack.
Identity governance has to move from account inventory to reachability governance. The central weakness here is not that Berlin lacked security tools, but that it lacked a defensible answer to a basic governance question: what can one account reach across the environment right now? That question matters for service accounts, shared credentials, and human users alike. Practitioners should assume that any access relationship not mapped is an open blast-radius assumption.
Blast-radius mapping is now a board-level control, not an operational luxury. Large public-sector environments cannot rely on post-incident forensics to tell them which accounts touch which systems. When attackers move laterally through legitimate access, the organisation’s ability to answer reachability questions becomes a resilience issue. The implication is direct: identity programmes must prove access scope continuously, not only during audits.
What this signals
Berlin’s case should push identity programmes away from static access reviews and toward continuous reachability governance. A compromised account is only containable if the organisation can answer, in near real time, what that identity can touch across systems, shared services, and delegated rights.
Identity blast radius: this is the practical metric that determines whether a breach becomes localised or city-wide. When identity maps are incomplete, segmentation becomes a transport control without governance context, and incident teams inherit a reconstruction problem instead of a containment decision.
For practitioners
- Build a live blast-radius map for every account Correlate each identity to the full set of systems, departments, and shared resources it can reach, then refresh that map as access changes.
- Separate segmentation from authorization reviews Treat network boundaries as transport controls only, and run entitlement reviews that identify inherited permissions and cross-department reach independently.
- Inventory shared and service credentials by owner and purpose Record who owns each shared login or service account, what it is for, and which assets it can access so containment does not depend on memory.
- Flag dormant and partially offboarded accounts as containment risks Prioritise accounts that still authenticate but no longer match an active business role, because those identities often preserve hidden reach across the environment.
Key takeaways
- Berlin’s breach shows that perimeter controls do not answer the harder question of runtime reachability, which is what determines actual blast radius.
- The incident exposed large volumes of data and credential material, making scope and containment a governance problem as much as a security one.
- Identity teams should treat blast-radius mapping as a standing control, because unanswered entitlement questions become attacker advantage during an incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on unclear account reach and excessive entitlement scope after compromise. |
| NHI-09 — NHI Reuse | Shared credentials and reused access paths turned one compromise into a wider breach surface. | |
| Recommendation — Map every account’s effective reach and remove privileges that exceed its business need. Track credential reuse across departments and eliminate duplicate access paths before they become a containment problem. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The incident progressed through valid access and movement across connected systems. |
| Recommendation — Hunt for credential access followed by lateral movement in environments with unresolved account reach. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core problem is unmanaged authorization scope across a large government network. |
| Recommendation — Continuously validate entitlements so each identity’s reachable systems are known before an incident. | ||
| CIS Controls v8 | CIS-5 — Account Management | The breach highlights account scope, ownership, and offboarding gaps across shared services. |
| Recommendation — Maintain an authoritative account inventory and revoke stale or unowned access paths quickly. | ||
Key terms
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Shared credentials: Shared credentials are passwords, tokens, or access secrets used by more than one person or system. They weaken attribution and revocation because no single identity owns the secret cleanly, which increases blast radius when the credential is exposed or abused.
What's in the full article
Unosecur's full article covers the operational detail this post intentionally leaves for the source:
- The full incident timeline from the first alert through the second leak disclosure
- Berlin-specific departmental and political response details that shape the public-sector context
- The vendor's explanation of how its identity mapping view correlates accounts across systems
- Operational examples of how access scope is narrowed once a cross-system identity map exists
Deepen your knowledge
NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on September 14, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org