Berlin officials confirm extortion attempt after August cyberattack

Berlin’s state government has officially confirmed it is the target of an extortion attempt. The admission comes weeks after hackers compromised the city’s administrative network in August. But officials are drawing a hard line: they won’t pay.

The statement, released by the Senate, also revealed that forensic investigators uncovered additional data outflows. The latest discovery involves the Senate Department for Mobility, Transport, Climate Protection and Environment. That’s a significant expansion of the breach’s scope.

So far, the city has not specified the exact nature of the stolen data. Nor have officials named the attackers. But the message is clear: Berlin will not negotiate.

Why Berlin is refusing to pay the ransom

It’s a decision that carries real consequences. Refusing to pay often means the stolen data gets published online. Yet cybersecurity experts have long argued that giving in to hackers only fuels the cycle.

“Paying ransoms doesn’t guarantee data recovery,” says one Berlin-based IT security analyst familiar with the case. “And it paints a target on your back for future attacks.”

The city’s stance aligns with broader German government policy. Federal authorities have repeatedly discouraged ransom payments to cybercriminals. The logic is straightforward: if everyone pays, the attacks will never stop.

The breach: what we know so far

The August attack hit the city’s state administrative network, a system that handles sensitive data across multiple departments. Initial reports suggested a limited compromise. Now, officials admit the damage may be deeper.

The newly confirmed data outflow from the transport and environment department raises serious questions. That department manages everything from public transit contracts to climate policy documents. If that data lands in the wrong hands, the fallout could be significant.

Forensic teams are still working to determine the full extent of the leak. The city has not provided a timeline for when the investigation might conclude.

What data was stolen?

Officials haven’t disclosed specific details. But based on typical attacks of this nature, the stolen data could include:

• Employee records and internal communications
• Contract documents and vendor information
• Project plans related to transport and environmental initiatives
• Potentially sensitive citizen data

Until the forensic analysis is complete, the full picture remains unclear.

How Berlin is responding to the cyberattack

The city has activated its crisis response protocols. IT teams are working around the clock to secure affected systems and prevent further unauthorized access.

Authorities have also notified the relevant data protection officers. That’s a legal requirement under German and EU regulations when personal data is compromised.

Public communication has been measured. Officials are balancing transparency with operational security. Sharing too much could tip off the attackers or expose additional vulnerabilities.

For residents and businesses that interact with the city’s digital services, the advice is to remain vigilant. Watch for suspicious communications that might reference data obtained from the breach.

The bigger picture: ransomware and public institutions

Berlin is far from alone in facing this dilemma. Public institutions across Germany and Europe have become prime targets for cybercriminals. The attacks are often opportunistic, exploiting known vulnerabilities rather than targeting specific victims.

But public entities face a unique pressure. They hold data on millions of citizens. A leak can expose personal information, financial records, and confidential government operations. The stakes are enormous.

Some cities have paid ransoms in the past, hoping to minimize damage. Others, like Berlin, have chosen to resist. The debate over which approach is more effective continues to divide experts.

What’s certain is that the threat isn’t going away. Municipalities across Germany are now reviewing their own cybersecurity postures, wondering if they could be next.

What happens now for Berlin?

The immediate focus is on damage control. Forensic teams continue their work. Law enforcement and federal cybersecurity agencies are likely involved in the investigation.

Longer term, the city will need to answer tough questions. How did the attackers get in? Were there warning signs that went unheeded? What steps will be taken to prevent a repeat?

Public trust is also on the line. Berlin residents expect their government to protect their data. A breach of this scale tests that confidence.

For now, the city’s position is firm. No ransom. No negotiation. Whether that decision proves wise will depend on what the hackers do next.

The coming weeks will be telling. If the stolen data appears online, the city will face a public relations crisis. If the attackers move on, Berlin’s resolve will have paid off.

Either way, this case is a stark reminder: no institution, however well-funded, is immune to cyber threats. And the choice to pay or not to pay is never easy.

Log4j RCE Scare Resurfaces

Another week, another Log4j nightmare. Security researchers flagged a fresh remote code execution (RCE) scare tied to the infamous logging library. The flaw, which first rocked the internet in December 2021, continues to haunt unpatched systems. This time, attackers are actively exploiting a variant that bypasses earlier mitigations.

If you thought the Log4j saga was over, think again. The vulnerability is now a gift that keeps on giving for cybercriminals. Organizations that failed to apply patches or left legacy components running are the prime targets. The message is blunt: if you haven’t audited your Java-based apps yet, you’re late.

Security teams are urged to recheck their inventory. A single forgotten instance could be the entry point for a full-scale breach. The Log4j RCE scare is a stark reminder that old vulnerabilities never really die—they just wait.

Minimus Shutdown: What It Means

In a quieter corner of the web, the Minimus service has shut down. For those unfamiliar, Minimus was a niche tool favored by privacy enthusiasts and researchers. Its sudden closure leaves a gap, but the details remain murky. The operators cited unspecified reasons, sparking speculation about legal pressure or financial strain.

The shutdown is a blow to users who relied on its unique features. Alternatives exist, but none offer the exact combination that made Minimus popular. It’s a reminder that even small services can vanish overnight, taking user trust and data with them.

For now, the community is scrambling to archive what it can. Some are already migrating to self-hosted solutions. The Minimus shutdown may be a footnote in the broader security landscape, but its impact on its niche audience is real.

Iranian Hacker Sanctions: A Coordinated Crackdown

Governments are tightening the screws on Iranian cyber operatives. New sanctions target individuals linked to state-sponsored hacking campaigns. The moves come after a series of attacks on critical infrastructure and diplomatic targets. Officials say the sanctions aim to disrupt funding and signal that such activities won’t be tolerated.

The sanctioned individuals are accused of working for the Islamic Revolutionary Guard Corps (IRGC). Their alleged activities include phishing, malware deployment, and data exfiltration. The sanctions freeze assets and ban transactions, but enforcement remains a challenge across borders.

This isn’t the first time Iranian hackers have faced sanctions, but the scope is broader. Experts note that while punitive measures help, they don’t stop the attacks. The real defense, they argue, lies in robust cyber hygiene and international cooperation.

Manchester Airports Group Cyberattack

UK’s Manchester Airports Group (MAG) fell victim to a cyberattack that disrupted operations. The group, which runs several major airports, reported service interruptions but kept flights running. The nature of the attack wasn’t immediately clear, but initial reports suggest a ransomware or DDoS incident.

Passengers faced delays and confusion as systems went offline. The group’s IT team worked to restore services, but the incident highlighted the vulnerability of critical transport infrastructure. It’s a stark example of how cyber threats can have physical-world consequences.

This attack follows a worrying trend of targeting airports and logistics hubs. The industry is increasingly on high alert, but the pace of attacks often outstrips defenses. For now, MAG is cooperating with authorities to investigate the breach.

Carhartt Breach: The Data Was Partly Fake

Remember the Carhartt data breach? Turns out, some of the leaked data was bogus. Security researchers discovered that the stolen records contained fake entries, possibly planted by the attackers to mislead or by someone testing the leak’s authenticity. The revelation complicates the response for affected users.

The mix of real and fake data means victims can’t be sure if their information is actually compromised. This uncertainty is a nightmare for identity protection services. Experts advise users to assume the worst and monitor their accounts, rather than dismissing the breach as a false alarm.

Carhartt has remained tight-lipped about the incident, but the company is likely working with law enforcement. For the rest of us, it’s a lesson in skepticism: not every leak is what it appears to be.

U.S. Bank Responds to Ransomware Gang’s Claims

U.S. Bank found itself in the crosshairs of a ransomware gang’s PR stunt. The group claimed to have breached the bank and threatened to release stolen data. But U.S. Bank pushed back, stating the claims are exaggerated or outright false. The bank says it found no evidence of a significant breach.

This cat-and-mouse game is common in the ransomware world. Gangs often name-drop big targets to gain notoriety, even when they lack real access. U.S. Bank’s response is a reminder that not all ransomware claims are credible.

Still, the incident underscores the reputational damage these threats can cause. Even a baseless claim can shake customer confidence and force costly investigations. For now, U.S. Bank is urging customers to stay vigilant and report any suspicious activity.

Final Thoughts

This week’s stories may not have dominated headlines, but they’re worth your attention. From the persistent Log4j RCE scare to the Minimus shutdown and Iranian hacker sanctions, the cybersecurity landscape remains volatile. Each incident offers a lesson in preparedness and resilience.

For more on related topics, check out our coverage of ransomware attack response strategies and critical infrastructure security best practices. Stay safe out there.

Two Flaws, One Urgent Message: Patch Your Next.js Now

If you’re running Next.js in production, this week’s security advisory from Vercel should grab your full attention. The company has shipped patches for two critical-severity vulnerabilities, and both allow unauthenticated remote code execution (RCE). That’s the worst kind of bug — no login required, no user interaction needed.

The first flaw lives in how Next.js parses AVIF image files. The second is a path traversal issue that only bites servers running on a Windows filesystem. Together, they paint a picture of an attack surface that’s wider than many developers realize.

Let’s break down what’s actually broken, who’s affected, and what you need to do before the weekend.

CVE-2026-75604: The Windows Path Traversal Flaw

Tracked as CVE-2026-75604, this vulnerability affects Next.js deployments on Windows servers. The bug is a classic path traversal — an attacker can craft a request that escapes the intended directory structure and reads or writes files outside the application root.

But it gets worse. In combination with other server-side weaknesses, this traversal can escalate to full remote code execution. The advisory notes that the impact is “critical” because the attack requires no authentication. If your Next.js app is hosted on a Windows machine — whether bare metal, a VM, or a Windows-based container — you’re in the blast radius.

Why Windows-Specific Bugs Slip Through

Path traversal issues often appear when developers assume a POSIX-style filesystem. Windows uses backslashes, drive letters, and different path normalization rules. A filter that blocks ../ on Linux might miss .. or encoded variations on Windows. It’s a subtle mismatch, and it’s exactly the kind of edge case that escapes code review.

The AVIF Image Parsing Vulnerability: RCE via a Single Image

The second flaw is arguably more alarming because it’s platform-independent. Next.js’s image optimization pipeline — the built-in next/image component — fails to properly validate certain AVIF files. A specially crafted image can trigger memory corruption or a logic error during parsing, leading to unauthenticated RCE.

Think about the attack scenario: an attacker uploads a malicious AVIF to any endpoint that processes images, or lures a user to a page that renders one. The server parses the file, and boom — the attacker gains code execution on the host. No credentials, no special privileges, just a carefully constructed binary file.

This is a reminder that image parsers are a historically dangerous attack surface. From JPEG to PNG to WebP, we’ve seen critical bugs in every major format. AVIF is newer, but it’s not immune.

Which Versions Are Affected — and Which Are Fixed

Vercel has confirmed that the following versions are vulnerable:

• Next.js 15.x — all versions prior to 15.4.6
• Next.js 14.x — all versions prior to 14.2.34
• Next.js 13.x — all versions prior to 13.5.11

The patched releases are 15.4.6, 14.2.34, and 13.5.11. If you’re on any version older than these, you’re exposed. There are no workarounds for either vulnerability — the only safe move is to upgrade.

What to Do Right Now

The fix is straightforward, but it requires action. Here’s your checklist:

1. Check your Next.js version — run npm list next or check your package.json.
2. Upgrade immediately — use npm install next@latest or pin to the specific patched version for your major release.
3. Rebuild and redeploy — a package update isn’t enough; you need to redeploy your application to ensure the new binary is live.
4. Review your image handling — if you use next/image with AVIF support, audit your upload endpoints for any suspicious files.
5. Monitor for exploitation — check your server logs for unusual image requests or path traversal patterns.

For teams managing multiple Next.js applications, this is also a good moment to audit your dependency tree. Transitive dependencies can pull in vulnerable versions without you noticing.

The Bigger Picture: Why Critical RCEs Keep Happening

Two critical RCEs in a single framework release might feel like a lot, but it’s part of a broader trend. As web frameworks add more built-in features — image optimization, server-side rendering, API routes — the attack surface grows. Each new feature is a new place for bugs to hide.

Next.js has been a dominant force in the React ecosystem for years, powering everything from startups to Fortune 500 sites. That popularity makes it a juicy target for attackers. The good news is that Vercel has a solid track record of responsible disclosure and rapid patching. The bad news is that patching only helps if you actually apply it.

If you’re on a managed hosting platform like Vercel itself, you may already be protected — the platform often applies patches automatically. But if you self-host on Node.js, whether on AWS, Azure, or your own infrastructure, the responsibility falls entirely on you.

Don’t Wait for the Exploit

Security advisories like this one are a race against time. The patches are public, which means exploit researchers and attackers alike now know exactly where to look. History shows that critical RCEs get weaponized within days, not weeks.

So here’s the bottom line: upgrade your Next.js deployment today. It’s a few minutes of work that could save you from a full server compromise. And while you’re at it, take a hard look at your image processing pipeline — it’s clearly a target.

For ongoing security updates on Next.js and other web frameworks, keep an eye on Vercel security advisories and the official Next.js changelog. Staying informed is half the battle.