# Berlin administration cyberattack and data breach > Live situation record from CLSTR: https://clstr.news/situations/berlin-administration-cyberattack-and-data-breach > Updated: 2026-09-06T13:14:00.000Z. Sources: 79. Developments: 2. The Berlin state administration was targeted by a major cyberattack involving the Rhysida ransomware group. Following a breach occurring between August 7 and August 12, 2026, the group demanded a ransom of 30 bitcoins, valued at approximately 2 million euros, threatening to release stolen data. Berlin Mayor Kai Wegner and Interior Senator Iris Spranger stated that the city would not pay the extortion demand. Following the refusal to pay, the Rhysida group published approximately 5.8 terabytes of stolen data, comprising 1.44 million files, onto the Darknet. The breach specifically targeted the Senate Departments for Building and Transport after hackers gained access to the Berliner Landesnetz. The compromised information includes personal records such as medical files, employment contracts, and scanned passports, as well as administrative employee data like employment certificates and emergency plans. Furthermore, the leak includes sensitive information regarding critical infrastructure, such as power plants, water supply, and emergency energy systems. The dataset reportedly contains vulnerability assessments for Berlin’s water supply and plans for chemical, biological, radiological, and nuclear (CBRN) threat scenarios. While officials stated that no data classified for national security was compromised, experts and political leaders have warned that the breach poses a threat. Green Party official Konstantin von Notz described the event as a ‘real data super-disaster’, while Roderich Kiesewetter warned that the leaked data could be exploited by terrorists or foreign states for sabotage. In response, the Senate Department for Urban Development, Building, and Housing has moved to tighten security measures. Investigations are being led by the BSI, BKA, and BfV. Recent criticisms from the Chaos Computer Club have highlighted failures in crisis management, alleging that a delay in disconnecting affected systems allowed attackers a seven-day window to continue extracting data. ## Claims - Approximately 1.44 million files totaling 5.8 terabytes have been published on the Darknet. (corroborated by 26 sources) - The hacker group Rhysida demanded a ransom of 30 Bitcoin, approximately two million euros. (corroborated by 24 sources) - The breach affected the Senate departments for Building and for Transport. (corroborated by 19 sources) - Experts suggest the leak may include highly sensitive data regarding civil protection and defense companies. (corroborated by 15 sources) - The leaked data includes personal information of administrative employees, such as employment certificates and emergency plans. (corroborated by 14 sources) - Hackers gained undetected access to parts of the Berlin state network between August 7 and August 12. (corroborated by 11 sources) - Konstantin von Notz described the data leak as a 'real data super-disaster' and blamed the federal government for massive failures. (corroborated by 10 sources) - The Berlin Senate refused to pay the ransom demand. (corroborated by 10 sources) - A subsequent data package containing internal access credentials was released by the attackers. (corroborated by 8 sources) - Roderich Kiesewetter stated that the data leak is of grave magnitude and endangers national security. (corroborated by 6 sources) - A cyberattack on the Berlin Senate administration resulted in the copying of 5.8 terabytes of data. (single source) - The stolen data includes personal information of thousands of citizens, critical infrastructure details, and military data. (single source) ## Timeline ### 2026-09-06: Berlin administration suffers massive data leak after ransomware attack The Rhysida ransomware group has leaked 5.8 terabytes of stolen data from Berlin's administration after the city refused a 2 million euro ransom. The leak includes sensitive critical infrastructure files. 45 sources. https://clstr.news/cluster/berlin-administration-suffers-massive-data-breach ### 2026-08-27: Berlin refuses to pay 2 million euro ransom following major cyberattack Berlin officials have refused a 2 million euro ransom demand from the Rhysida ransomware group following a cyberattack that compromised 5.79 terabytes of state data. 48 sources. https://clstr.news/cluster/saxony-anhalt-election-cdu-and-die-linke-rivals-maintain-personal-rapport --- Cite as: Berlin administration cyberattack and data breach. CLSTR, https://clstr.news/situations/berlin-administration-cyberattack-and-data-breach