[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 79 sources · 11 days · First seen · Last updated

Berlin administration cyberattack and data breach

Overview

The Berlin state administration was targeted by a major cyberattack involving the Rhysida ransomware group. Following a breach occurring between August 7 and August 12, 2026, the group demanded a ransom of 30 bitcoins, valued at approximately 2 million euros, threatening to release stolen data. Berlin Mayor Kai Wegner and Interior Senator Iris Spranger stated that the city would not pay the extortion demand.

Following the refusal to pay, the Rhysida group published approximately 5.8 terabytes of stolen data, comprising 1.44 million files, onto the Darknet. The breach specifically targeted the Senate Departments for Building and Transport after hackers gained access to the Berliner Landesnetz. The compromised information includes personal records such as medical files, employment contracts, and scanned passports, as well as administrative employee data like employment certificates and emergency plans.

Furthermore, the leak includes sensitive information regarding critical infrastructure, such as power plants, water supply, and emergency energy systems. The dataset reportedly contains vulnerability assessments for Berlin’s water supply and plans for chemical, biological, radiological, and nuclear (CBRN) threat scenarios. While officials stated that no data classified for national security was compromised, experts and political leaders have warned that the breach poses a threat. Green Party official Konstantin von Notz described the event as a ‘real data super-disaster’, while Roderich Kiesewetter warned that the leaked data could be exploited by terrorists or foreign states for sabotage.

In response, the Senate Department for Urban Development, Building, and Housing has moved to tighten security measures. Investigations are being led by the BSI, BKA, and BfV. Recent criticisms from the Chaos Computer Club have highlighted failures in crisis management, alleging that a delay in disconnecting affected systems allowed attackers a seven-day window to continue extracting data.

Entities

Rhysida · Iris Spranger · Berlin · Kai Wegner · Mario Voigt

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. 5 days ago

    [TECHNOLOGY] 45 sources
    Berlin administration suffers massive data leak after ransomware attack

    The Rhysida ransomware group has leaked 5.8 terabytes of stolen data from Berlin's administration after the city refused a 2 million euro ransom. The leak includes sensitive critical infrastructure files.

  2. 15 days ago

    [TECHNOLOGY] 48 sources
    Berlin refuses to pay 2 million euro ransom following major cyberattack

    Berlin officials have refused a 2 million euro ransom demand from the Rhysida ransomware group following a cyberattack that compromised 5.79 terabytes of state data.

Sources

4investors.de · abendblatt.de · actualidad.rt.com · ad-hoc-news.de · amica.de · berliner-abendblatt.de · berliner-sonntagsblatt.de · berliner-zeitung.de · berlinstory-news.de · bild.de · bitcoinethereumnews.com · biziday.ro · braunschweiger-zeitung.de · cmjornal.pt · connectedtoindia.com · cryptoast.fr · cybernoz.com · cybersecitalia.it · drweb.de · egovernment.de · epochtimes.de · ertnews.gr · faz.net · finanzen.net · finanznachrichten.de · focus.de · harzkurier.de · heute.de · hna.de · ikz-online.de · infomagazine.ma · inside-it.ch · it-boltwise.de · it-daily.net · itbiz.cz · kuruc.info · lagacetaonline.com.ar · ledauphine.com · leinetal24.de · leprogres.fr · lifepr.de · madeinbocholt.de · mediaindonesia.com · merkur-online.de · mobil.zeit.de · mopo.de · morgenpost.de · myportal.gr

This summary has been updated 8 times: see revision history