Berlin refused a 30 Bitcoin ransom, leading hackers to leak 6TB of sensitive state administration and national defense data on the dark web.

When a ransomware gang dumps nearly six terabytes of state administration files onto the dark web, ignoring them does not make the problem go away. The Rhysida ransomware group recently carried out this exact threat against Berlin after local authorities refused to pay a thirty Bitcoin ransom.

At the end of August, Berlin’s state government confirmed it was dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.

Rhysida claimed it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:

• Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
• Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.
• Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
• Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
• Classified information: data related to classified-material handling and documents allegedly containing state secrets.
• Critical infrastructure: vulnerability analyses concerning Berlin’s water supply.
• Identity documents: passports and ID cards from personnel records.
• Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.

The group also claimed that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified.

The scale of the breach is staggering. Investigators are now looking at roughly 1.4 million files containing personal details of civil servants, internal infrastructure records, and critical government data.

The fallout goes far beyond routine data theft. Investigative journalist Lars Winkelsdorf pointed out the gravity of the situation on social media.

“In addition to LKA documents related to investigations, the files also include plans concerning national defense—ranging from the federal government’s secret communication channels in the event of an apocalypse to defense-related companies and emergency plans developed by government agencies,” Winkelsdorf wrote.

Exposing crisis response plans and secret communication channels turns a financial shakedown into a national security headache.

Worse still, the leaked material includes files concerning chemical, biological, radiological, and nuclear threats.

“Among the published files is a folder titled “AG CBRN-Rahmenplanung.” CBRN stands for chemical, biological, radiological and nuclear threats,” notes the Euronews report

Having that kind of operational data floating around public forums gives hostile actors a blueprint for disaster.

Refusing to pay ransoms is the right policy, but it rarely stops the bleeding once the network is compromised. Governments keep treating cybersecurity like an IT expense rather than an existential line of defense.

Until boards start treating network segmentation with the same seriousness as physical security, we will keep watching expensive countdown timers tick down to zero.

Berlin’s state government announced the launch of a crisis response after the threat actors published the stolen data.

“A ‌central ⁠crisis unit will oversee the review, verification and assessment of the leaked data and support efforts to inform affected citizens and ​businesses, said the ​city.” Reuters reports.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Berlin)

FBI probes suspected breach at IDScan.net after dark web service Nexus offered 153M+ US and Canadian driver’s license scans.

A dark web identity theft service called Nexus appeared on September 1, 2026, offering searchable access to more than 153 million scanned driver’s licenses belonging to people in the United States and Canada.

The FBI’s New Orleans field office opened a formal investigation the same day. Brian Krebs at KrebsOnSecurity, who broke the story, traced the source to idscan.net, a New Orleans-based identity verification company whose clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, and the financial services firm Jack Henry.

“On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.” wrote Krebs. “The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.”

The record total was also increasing by roughly 400,000 per day at the time of publication, which the operators attributed to ongoing active exfiltration from a live breach they claim has been running for over a year.

Krebs found his own driver’s license in the database after a source alerted him to the service. The operators had posted his Virginia license as a free sample on the Russian cybercrime forum Exploit. Each record contains six images of the license, showing the front and back in visible, infrared, and ultraviolet light, with a timestamp. Krebs’ timestamp matched a June 2025 flight and car rental.

He then checked nine friends and relatives, and everyone who found their license confirmed traveling or renting a car around the same date. His license and his mother’s, who rented a Hertz car with him that day, had timestamps just seconds apart.

Security researcher Zach Edwards, whose license also appeared in Nexus, narrowed the source further. His timestamp matched a trip to Las Vegas for DEF CON in August. He hadn’t rented a car, but he had shown his license at a marijuana dispensary: Planet13, a multi-state chain. In 2022, idscan.net published a press release announcing an exclusive identity verification partnership with Planet13’s dispensaries nationally. The company now serves more than 1,000 marijuana dispensaries in 19 states, and its own documentation confirms that its technology scans IDs with both infrared and ultraviolet light, precisely the format of the images appearing in Nexus.

Idscan.net performs more than 21 million verifications per month at more than 20,000 locations globally. Its client list spans car rentals, retailers, hotels, financial services, and dispensaries, which explains both the volume and the geographic spread of the records. The dataset also includes marijuana dispensary cards and records marked with the notation “CAC,” which may refer to Common Access Cards, the government-issued credentials used to enter federal buildings and secure facilities. If confirmed, that would significantly expand the security implications beyond consumer identity theft.

The database reportedly contained the driver’s licenses of U.S. Defense Secretary Pete Hegseth and the FBI’s assistant director, but not FBI Director Kash Patel’s.

Idscan.net said Krebs’ findings would help its internal investigation but gave no further details. The company later said it was working with law enforcement and forensic experts. Soon after the story became public, the Nexus service went offline.

Identity verification systems that require driver’s licenses are spreading sensitive data across an expanding network of third-party vendors, and oversight mechanisms haven’t kept pace. Every bar, hotel, car rental counter, dispensary, and age-verification system that scans an ID is creating a copy of that image in a system whose security posture the cardholder has no way to assess.

The idscan.net incident, if confirmed at the reported scale, would be among the largest exposures of government-issued identity document images ever recorded.

Krebs reports that Nexus shut down after his article, while the FBI opened an investigation after learning that stolen IDs may include licenses belonging to FBI agents.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Nexus)

412,000 The Town 2025 festival buyer records are being sold for $10,000, with Brazil’s data openly marketed for bank fraud, loans and SIM registration.

A seller on a Russian-language data-trading forum listed what they’re calling a Ticketmaster database on September 2, claiming over 412,000 Latin American purchase records with a heavy concentration of Brazilian data. Ransomnews’s analysis confirms the sample is genuine ticket-buyer data from The Town 2025, the São Paulo music festival, though who actually lost the data and how remains unconfirmed.

“The listing is headed “SELLING NEW TICKETMASTER DATABASE” and describes a global ticketing platform, Latin America region, with an internal ticketing database as the source and a breach date of 28 August 2026. It advertises 412,192 rows across 34 columns.” reported Ransomnews. “The country breakdown is dominated by Brazil at 251,557 records, or 61%, with Argentina at 219, Chile 155, Colombia 144, Peru 123 and Paraguay 72, plus nine more countries not itemised.”

The seller is asking $10,000 for the full database, or $80 for every 1,000 records, with escrow available. The 251,557 Brazilian records make up about 61% of the database, meaning the seller is effectively asking around four cents per person.

The data includes names, email addresses, CPF numbers, phone numbers, neighborhoods, ticket types, and payment details. Together, these details provide a detailed profile that could be used for identity theft and fraud.

“The seller’s own notes are the part that should concern Brazilian readers most. Alongside the sales copy, the listing states that the CPF numbers work “for Brazilian bank fraud, loan apps and SIM registration”.” continues the report.”That is not our characterisation of the risk. It is the seller describing the intended use of the file.”

Ransomnews ran the kind of checks that usually expose fake listings within minutes, and this one kept passing. Purchase IDs across the sample rise in strict chronological order, exactly what an auto-incrementing database key produces and something close to statistically impossible to fake by chance. Every CPF number in the sample passes Brazil’s official check-digit validation, phone area codes correctly match the state listed on each row rather than defaulting to a single city, and neighborhood names map precisely onto their stated cities, the kind of granular accuracy a random data generator simply doesn’t produce.

The ticket prices provide another strong sign that the database is genuine. Full-price tickets cost exactly 975 reais, while discounted tickets cost 487.50 reais, matching Brazil’s legal student discount. The database also lists Pix and Elo as payment methods, both widely used in Brazil.

Even the incomplete records look realistic. Complimentary tickets issued by the festival’s back office contain no name or CPF, only the ticket type and date. These kinds of inconsistencies are common in real databases but would be unusual in fabricated data.

However, there is an important detail that challenges the claim of a direct Ticketmaster breach. Every record in the sample has exactly the same processing timestamp: October 1, 2025 at 23:05:41, about two weeks after the festival ended.

A live database dump would normally contain different timestamps. The identical timestamp instead suggests that the data may have been exported in a single batch after the event and then shared with a promoter, sponsor, payment provider, or another partner. Ransomnews therefore warns that blaming Ticketmaster directly would go beyond what the available evidence currently shows.

That distinction matters more than it might seem, because it points at an industry-wide blind spot rather than one company’s failure. Brazilian ticketing requires CPF collection to enforce discount eligibility rules, which means live-events companies routinely end up holding a national identity number, a verified phone, and a home neighborhood for hundreds of thousands of people, data with the sensitivity of a bank record sitting inside an industry with nothing like a bank’s security requirements. The moment that data gets exported into a spreadsheet to reconcile ticket sales with a partner, which happens constantly and rarely makes headlines, it becomes dramatically easier to lose.

“If you bought tickets to The Town 2025, treat your CPF as exposed.” concludes the report. “A CPF cannot be reissued the way a password can, and the seller is explicitly marketing these numbers for credit and telecoms fraud.”

If you bought tickets to The Town 2025, the practical response here isn’t panic, it’s specific vigilance. A CPF can’t be reissued the way a password gets reset, so treat it as permanently exposed and check your credit record through Brazil’s Central Bank registry or services like Serasa for accounts you didn’t open. Watch closely for SIM swap attempts given the seller’s explicit mention of telecom fraud, and be skeptical of any inbound call or message referencing your actual festival purchase, since whoever holds this file knows exactly which days you attended and how you paid, more than enough detail to make a scam call sound completely legitimate.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, The Town 2025)

UK police legal database breach exposed officers’ names and work emails, increasing phishing risks. NCA is investigating.

The Police National Legal Database (PNLD), the legal reference system used by all 43 Home Office police forces in England and Wales, confirmed that a data breach exposed the contact details of police officers, staff, and criminal justice professionals and published them on the dark web. The breach also hit Ask the Police, a public Q&A service hosted on the same platform. The National Crime Agency is involved in the investigation.

“Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web.” reads the notice of data breach. “There is no evidence to suggest that passwords or other security credentials have been compromised.”

UK police is investigating the security breach with the help of the National Crime Agency (NCA) and private cybersecurity firms.

The PNLD reported 108,429 police registrations in its 2025-26 annual summary, which gives some sense of the potential user base affected, though PNLD has not disclosed how many individuals are actually in the breached dataset. No victim count, no timeline of when the intrusion began, no statement on how much data was taken.

“The data security incident primarily affected the Police National Legal Database (PNLD) which hosts the Ask the Police site.” continues the notice. “As a result, some names and email addresses of people who have previously submitted a question to Ask the Police have been published on the dark web.”

Ask the Police is a public-facing service where anyone can submit questions to the police. The exposure of those submitters’ names and emails alongside police officers’ work contact details creates two distinct risk categories: named officers are now more vulnerable to targeted phishing, and members of the public who contacted police services have had that fact made visible on criminal forums.

“PNLD also provides legal information, products and services to UK police forces and criminal justice organisations; it is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders.” concludes the notice.

All affected organizations were promptly notified, provided guidance, and the incident was reported to the UK Information Commissioner’s Office (ICO).

The extortion group ExfilSquad listed PNLD on its leak site on July 26, though PNLD has not attributed the incident to the group.

Cybersecurity firm VenariX reviewed samples associated with 11 of ExfilSquad’s 15 claimed victims and found structures consistent with Microsoft Dataverse across all of them, pointing toward a likely campaign pattern involving misconfigured Microsoft Power Pages portals, public-facing sites where overly permissive table access settings can expose data to anyone who visits the page without logging in.

PNLD’s 2023-24 annual summary stated the database uses Microsoft Power Platform technology, and the breach notice page references assets on Microsoft’s content.powerapps.com domain, which corroborates the platform connection. That said, neither PNLD’s notice nor VenariX’s report has confirmed a PNLD-specific endpoint, permission setting, or access route, the Power Pages hypothesis remains exactly that: a hypothesis consistent with the evidence, not a confirmed root cause.

“The reviewed data is most consistent with extraction from public Microsoft Power Pages portals that were configured to allow anonymous users to read Dataverse records.” states VenariX. “Microsoft documents that Power Pages can expose Dataverse tables through its portal Web API using the /_api/<EntitySetName> route, and that access is governed by table permissions assigned through web roles.

A likely flow is:

Public Power Pages portal → Anonymous Users web role → Broad table permission → Power Pages Web API or legacy OData feed → Dataverse data export“

For any organization running Microsoft Power Pages: VenariX recommends reviewing Anonymous Users table permissions, Web API settings, and legacy OData feeds, then validating access from an unauthenticated browser session. Microsoft provides a tenant-level control that blocks unauthenticated users from reading Dataverse data while still allowing public form submissions. That’s the kind of configuration that should have been validated before deployment, not after a breach.

Police officers and staff whose details were exposed should be alert to targeted phishing that uses their name, organization, and work email, the exact combination now available on the dark web.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, UK Police)