> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# A Berlin district blocks the US security tool brought in to clean up its hack
- URL: https://globalfeed.ai/en/a-berlin-district-blocks-the-us-security-tool-brought-in-to-clean-up-its-hack/
- Published: 2026-09-06T21:12:37.000Z
- Updated: 2026-09-06T21:12:37.000Z
- Description: After the Rhysida attack, Berlin's Senate hired CrowdStrike for forensics. The Lichtenberg district refuses to run the software on its network, citing near unlimited access to staff machines.
- Author: GlobalFeed Editor
- Tags: CrowdStrike, Berlin, Rhysida, ransomware, data sovereignty, x-CrowdStrike, dil-en, elle, video, x-gitti

After the ransomware attack on Berlin's state network, the Senate hired US-based CrowdStrike to check whether the attacker left anything behind. But [Tagesspiegel reports](https://www.tagesspiegel.de/berlin/bezirke/erhebliche-bedenken-nach-hackerangriff-auf-berlin-lichtenberg-verweigert-der-vom-senat-beauftragten-us-firma-den-it-zugang-16021525.html?ref=globalfeed.ai) that the Lichtenberg district decided on Sunday not to run the software on its own servers, with staff councils informed on Monday.

## The objection

The district's problem is the cleanup tool itself. According to internal correspondence that has become public, it argues the software would gain "nearly unrestricted" access to all of its data, personal information included, and would probably be impossible to remove afterwards. The second objection is surveillance: because the agent sits on staff work machines, it can see both what happens on the machine and the employee using it.

## What the attack was

The Rhysida group took [5.79 terabytes](https://cybernews.com/news/stolen-berlin-government-files-dumped-on-dark-web-rhysida/?ref=globalfeed.ai) from the Berlin state network between 7 and 12 August. The breach was detected on 14 August. After a bitcoin ransom of roughly two million euros was refused, the data was published on 4 September. It covers two Senate departments and includes personnel files, contracts, criminal and administrative proceedings, payment records, salary lists, critical infrastructure analyses, and passwords typed into Word documents.

One detail from the leak shows the state knew about its own weakness: an internal meeting record from February states that classified information could not be processed in Berlin's public administration because the secure network architecture had not been implemented.

## Why it matters

The incident opened a second argument: the tool that cleans up an intrusion has to see everything the intruder saw. When a public body hands that access to a foreign vendor, the data sovereignty question arrives exactly at the moment of crisis. Berlin shows that the debate about running security software in house is not theoretical.

## Sources

- **Primary source:** [Tagesspiegel](https://www.tagesspiegel.de/berlin/bezirke/erhebliche-bedenken-nach-hackerangriff-auf-berlin-lichtenberg-verweigert-der-vom-senat-beauftragten-us-firma-den-it-zugang-16021525.html?ref=globalfeed.ai) on the district's decision
- Leak details: [Cybernews](https://cybernews.com/news/stolen-berlin-government-files-dumped-on-dark-web-rhysida/?ref=globalfeed.ai)