[CLSTR]
< Back to situation

[REVISION HISTORY]

Berlin cyberattack: Rhysida leaks 1.4 million files

Updated 14 times since CLSTR started tracking revisions of this situation.

What changed

2026-09-06 08:59 UTC → 2026-09-08 15:28 UTC · added removed

The cyberattack on the Berlin state network has escalated into a massive data leak following the Senate’s refusal to pay a ransom. The hacker group Rhysida released approximately 1.44 million stolen files, totaling between 5.26 and 5.8 terabytes of information, on the darknet after the city declined a demand for 30 Bitcoin, valued at roughly 2 million euros. The breach, which occurred between August 7 and August 12, directly impacted the city's departments for urban development, housing, transport, and the environment. These agencies were disconnected from the administrative network on August 14 to contain the damage. The leaked data includes highly sensitive personnel records, such as birth certificates, home addresses, salary details, work certificates, job offers, and employee evaluations. More critically, the breach exposed information regarding Berlin’s infrastructure and emergency planning. This includes documents related to the planning, including ‘AG CBRN-Rahmenplanung’, which details response plans CBRN-Rahmenplanung’ documents for chemical, biological, radiological, and nuclear threats. The leak contains information on critical infrastructure such threats, as well as details on power plants, fuel depots, and water supply systems, as well as contingency plans for protecting essential services like hospitals and police during emergencies. New details indicate the exposure also includes documents regarding defense-related companies and contingency plans for the German Parliament. While experts have praised the Berlin Senate's decision not to yield systems. In response to extortion, IT security expert Manuel Atug has accused the state of “gross negligence” regarding cybersecurity protocols. Berlin fallout, Governing Mayor Kai Wegner has confirmed announced that sensitive the Senate plans to establish a support center for citizens and companies. Digital State Secretary Florian Hauer reported that while military defense data was indeed compromised, emphasizing that the state not involved, officials cannot be extorted. CDU politician Roderich Kiesewetter has joined warnings that rule out the breach poses theft of sensitive information regarding critical infrastructure or personal citizen data. While the Mayor stated the immediate attack has been contained, authorities are engaged in a significant threat to national security and time-consuming analysis of the state's ability to defend critical infrastructure. stolen files. The Federal Office for Information Security (BSI) Chaos Computer Club (CCC) has issued warnings regarding cautioned that determining the fallout, noting increased risks exact extent of targeted phishing attacks and ‘hack-and-leak’ operations. the breach could take many weeks.

Versions

  1. 2026-09-08 15:28 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  2. 2026-09-06 08:59 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  3. 2026-09-06 04:03 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  4. 2026-09-05 19:31 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  5. 2026-09-05 15:04 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  6. 2026-09-05 13:22 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  7. 2026-09-05 12:17 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  8. 2026-09-05 10:53 UTC Berlin cyberattack: Rhysida leaks 1.4 million files
  9. 2026-09-05 07:17 UTC Berlin state network cyberattack and massive data leak
  10. 2026-09-04 16:54 UTC Berlin state network cyberattack and data leak
  11. 2026-09-04 14:43 UTC Berlin state network cyberattack and service restoration
  12. 2026-08-28 03:42 UTC Berlin state network cyberattack and service restoration
  13. 2026-08-26 14:45 UTC Berlin state network cyberattack and service restoration
  14. 2026-08-24 08:33 UTC Berlin state network cyberattack and service restoration
  15. 2026-08-20 05:45 UTC Berlin state network cyberattack

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.