Berlin ransomware breach: what the account blast radius gap exposed

TL;DR: Unosecur’s analysis shows Rhysida’s breach of Berlin’s state government network showed that segmentation, VPN access, and standard authentication did not answer the key question of what a compromised account could reach across departments, leaving 5.79 terabytes and nearly 6,000 credential files exposed. The breach shows that runtime authorization mapping, not perimeter control, determines blast radius in large identity-heavy environments.

Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “The Ten-Day Gap That Let Rhysida Spread Across Berlin's 600-Site Government Network.”.

By the numbers:

• Rhysida claimed 5.79 terabytes across 1.44 million files.
• Berlin’s leak also included nearly 6,000 files containing login credentials.

Key questions

Q: What fails when a ransomware team can authenticate users but cannot map their blast radius?

A: Containment fails because the organisation can block network paths without knowing which systems a compromised identity can still reach.

Q: Why do standing privileges make ransomware incidents harder to contain?

A: Standing privileges give an attacker more authority after the first login, which shortens the time needed to move from access to disruption.

Q: What signs show that blast-radius governance is not working?

A: The warning signs are slow containment decisions, manual access reconstruction, unclear ownership of shared accounts, and uncertainty about which systems a department can actually touch.

Practitioner guidance

• Build a live blast-radius map for every account Correlate each identity to the full set of systems, departments, and shared resources it can reach, then refresh that map as access changes.
• Separate segmentation from authorization reviews Treat network boundaries as transport controls only, and run entitlement reviews that identify inherited permissions and cross-department reach independently.
• Inventory shared and service credentials by owner and purpose Record who owns each shared login or service account, what it is for, and which assets it can access so containment does not depend on memory.

Bottom line: Berlin’s breach shows that perimeter controls do not answer the harder question of runtime reachability, which is what determines actual blast radius.

What's in the full article

Unosecur's full article covers the operational detail this post intentionally leaves for the source:

• The full incident timeline from the first alert through the second leak disclosure
• Berlin-specific departmental and political response details that shape the public-sector context
• The vendor's explanation of how its identity mapping view correlates accounts across systems
• Operational examples of how access scope is narrowed once a cross-system identity map exists

👉 Read Unosecur’s analysis of the Berlin ransomware breach and account blast radius →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →