Berlin's ransomware leak shows disclosure rules aren't defense

Google patched twelve Chrome vulnerabilities this week, among them a V8 flaw already under active attack, six days before the EU's Cyber Resilience Act forces manufacturers to report exploited flaws within 24 hours. Call it coincidence or a vendor reading the deadline correctly: either way, the patch landed with the urgency the new rule is meant to enforce. The same week, Berlin's public administration found the limits of what any disclosure rule can do. The city refused a two million euro ransom, and hackers leaked six terabytes of its data anyway, including infrastructure maps and the personal details of citizens and staff.

These are not the same failure. The Cyber Resilience Act governs what happens after a vulnerability is found: report it fast, patch it fast, tell the regulator. Berlin's case is about what happens once an attacker is already inside and has already taken the data. No reporting deadline retrieves six terabytes from the dark web, and no amount of regulatory maturity substitutes for the harder, slower work of keeping attackers out and holding usable backups when they get in anyway. As Pplware reports, Berlin chose not to fund the people who took its data, which is the right call and, on its own, not a cybersecurity strategy.

A disclosure deadline does not retrieve six terabytes from the dark web.

A second story this week is about control rather than crime. CISPE, the European cloud industry association, told the Commission that Broadcom's strategy for enterprise AI is designed to lock customers into its own stack, as Heise reports. This is not CISPE's first complaint about the company: in March it called Broadcom's purge of VMware's independent partners a "death sentence" for European cloud providers. Six months on, the fight has moved from who gets to resell virtualisation software to who gets to build the enterprise AI layer on top of it, and it is the same European digital sovereignty question this column keeps returning to, now one level higher in the stack.

Consumers…

If your personal data touched Berlin's public administration, in the exposed infrastructure maps or the staff and citizen records now on the dark web, treat unexpected calls or emails referencing your details with more suspicion than usual for the coming months. That is the one direct consumer exposure from either story this week; the Broadcom fight plays out one layer up, in the enterprise cloud contracts that keep the consumer-facing services you use running, not in anything you buy or click on directly.

Businesses…

Six days is not much runway if the Cyber Resilience Act's 24-hour exploited-vulnerability reporting duty is not already built into your incident response process, and Google's patch, landing just ahead of that date, is a reasonable signal that vendors are already treating the deadline as a real constraint rather than a formality. Separately, any business running enterprise workloads on Broadcom's VMware stack should read CISPE's complaint as a warning about where that dependency is heading next: from licensing terms to AI infrastructure control. OVHcloud and other European cloud providers are not a drop-in replacement for an existing VMware estate, but they are the concrete alternative to point a migration plan at before the decision gets made for you.

Government…

Berlin's refusal to pay is consistent with the harder line European public administrations have increasingly taken on ransom demands, and it is the right policy on its own terms: paying finances the next attack. But the leak that followed it is a reminder that the policy only holds up when paired with prevention and recovery capacity that most public administrations, Berlin included, still do not visibly have. The Cyber Resilience Act gives national authorities like Germany's BSI new enforcement teeth over vendors; under that law specifically, it gives them no authority over an administration's own security posture, which remains a separate and unfinished job.

Sources

• Google patched a Chrome V8 zero-day exploited in the wild days before the EU Cyber Resilience Act's 24-hour exploited-vulnerability reporting duty takes effect · The Next Web
• CISPE warned that Broadcom's enterprise AI strategy is designed to control customer choice, prompting formal EU complaints · Heise Online
• Berlin's public administration refused a two million euro ransom demand and had six terabytes of data leaked on the dark web anyway · Pplware