A ransomware attack on Berlin’s state network in August 2026 exposed how a single user action can give hackers access to public systems, cybersecurity expert Marco Di Filippo said. The city refused to pay a ransom demand, while files taken in the attack were later published online.
Di Filippo, who works for cybersecurity firm Whitelisthackers, told Euronews that the Berlin incident involved a technique known as ClickFix. A user was directed to a website and prompted to enter a command on their computer, effectively enabling the attackers’ access, he said.
The ransomware group Rhysida claimed responsibility and demanded 30 bitcoin, according to The Record. Authorities had not publicly attributed the attack to the group, and the amount and contents of the stolen data were not independently verified in the reporting.
Training and access controls are key defenses
Di Filippo said the incident reflected both a lack of user awareness and excessive access privileges. In his view, a user should not have had the permissions needed to carry out the action that opened the way into the network.
He said ethical hackers test company systems using methods similar to those used by criminal attackers, but work under contract to identify weaknesses before they are exploited. Their findings are documented for clients so vulnerabilities can be fixed.
Di Filippo also pointed to “ghost pairing,” in which a person who follows a link in a text or WhatsApp message may unknowingly give an attacker access to private messages, media and contacts. Germany’s Federal Office for Information Security has warned about the method, the interview said. The advice cited includes checking unexpected messages carefully and enabling two-factor authentication.
Nicole French 
Clayton Ward