# Berlin cyberattack: Rhysida leaks 1.4 million files > Live situation record from CLSTR: https://clstr.news/situations/berlin-state-network-cyberattack > Updated: 2026-09-04T13:00:00.000Z. Sources: 116. Developments: 5. The cyberattack on the Berlin state network has escalated into a massive data leak following the Senate’s refusal to pay a ransom. The hacker group Rhysida released approximately 1.44 million stolen files, totaling between 5.26 and 5.8 terabytes of information, on the darknet after the city declined a demand for 30 Bitcoin, valued at roughly 2 million euros. The breach, which occurred between August 7 and August 12, directly impacted the city's departments for urban development, housing, transport, and the environment. These agencies were disconnected from the administrative network on August 14 to contain the damage. The leaked data includes highly sensitive personnel records, such as birth certificates, home addresses, salary details, and employee evaluations. More critically, the breach exposed information regarding Berlin’s infrastructure and emergency planning, including ‘AG CBRN-Rahmenplanung’ documents for chemical, biological, radiological, and nuclear threats, as well as details on power plants, fuel depots, and water supply systems. In response to the fallout, Governing Mayor Kai Wegner announced that the Senate plans to establish a support center for citizens and companies. Digital State Secretary Florian Hauer reported that while military defense data was not involved, officials cannot rule out the theft of sensitive information regarding critical infrastructure or personal citizen data. While the Mayor stated the immediate attack has been contained, authorities are engaged in a time-consuming analysis of the stolen files. The Chaos Computer Club (CCC) has cautioned that determining the exact extent of the breach could take many weeks. ## Claims - The hackers demanded a ransom of approximately 2 million euros in Bitcoin. (corroborated by 37 sources) - Berlin Mayor Kai Wegner stated the city was targeted by extortion following a cyberattack but refused to yield to demands. (corroborated by 36 sources) - Hackers published approximately 1.4 million stolen files from the Berlin municipal authority on the darknet. (corroborated by 32 sources) - The leaked data includes personal documents such as work certificates, job offers, and employee evaluations. (corroborated by 28 sources) - The cyberattack on August 14 caused municipal departments, specifically housing and environment, to be disconnected from the network for one week. (corroborated by 21 sources) - The BSI warned of increased risks of phishing and hack-and-leak operations following the data leak. (corroborated by 7 sources) ## Timeline ### 2026-09-04: Berlin administration data leak: Rhysida releases 1.4 million files on dark web The Rhysida hacker group has leaked 1.44 million stolen files from Berlin's administration on the dark web after the city refused a 2 million euro ransom demand. 93 sources. https://clstr.news/cluster/berlin-refuses-to-pay-ransom-following-rhysida-cyberattack ### 2026-08-26: Berlin state network cyberattack may have leaked sensitive data Berlin authorities warn that sensitive personal data may have been leaked following a cyberattack on the state network that has since evolved into an extortion attempt. 10 sources. https://clstr.news/cluster/berlin-administration-faces-potential-sensitive-data-leak-in-cyberattack ### 2026-08-23: Berlin restores state network services after major cyberattack Berlin has reconnected several state departments to its network following a cyberattack that disrupted housing allowances for 50,000 households. Officials warn that investigations continue. 6 sources. https://clstr.news/cluster/berlin-restores-state-network-services-after-major-cyberattack ### 2026-08-19: Berlin state network hit by serious cyberattack A serious cyberattack on Berlin's state network has forced the disconnection of two Senate departments. Officials report no sensitive data leaks and are working with federal agencies to restore services. 8 sources. https://clstr.news/cluster/berlin-state-network-hit-by-serious-cyberattack ### 2026-08-17: Berlin state network hit by cyberattack, paralyzing two departments A cyberattack on Berlin's state network has paralyzed two major Senate departments, cutting off internet and email access and potentially exposing sensitive data. 20 sources. https://clstr.news/cluster/berlin-senate-administration-hit-by-cyberattack --- Cite as: Berlin cyberattack: Rhysida leaks 1.4 million files. CLSTR, https://clstr.news/situations/berlin-state-network-cyberattack