Berlin state government network breach: Rhysida steals and publishes data after refused extortion demand
Rhysida stole data from Berlin's state administration in August 2026 and published it on 4 September after Berlin refused to pay. The government confirms theft but not scope. Affected people are to be told by authorities; if you hear from Berlin, check it is genuine.
Nothing to patch. If you live or work in Berlin or deal with its administration, expect a notice from the authorities; treat unexpected emails, calls or messages about this leak with caution and contact the authority directly through its official website. Change any reused passwords.
What’s happening
Berlin's state government says data was taken from its administrative network between 7 and 12 August 2026. The attack came to light on 14 August, when the affected departments, notably those for Transport and Environment and for Urban Development, were disconnected. On 28 August Governing Mayor Kai Wegner said Berlin was being blackmailed and would not meet the demands, and the ransomware group Rhysida listed the state on its leak site. Berlin's Senate Chancellery says Rhysida asked for 30 bitcoin. Rhysida claimed 5.79 terabytes, about 1.44 million files, and personal details of 12,076 people; these are the attackers' figures, and Berlin has confirmed theft but not the scope. No payment was made, and the data was published on 4 September. Berlin set up a crisis unit and says affected people and businesses will be notified by the relevant authorities. As of the Chancellery's 16 October update, analysis of the data was continuing and its page did not say whether notifications had gone out. The method of entry has not been disclosed, and officials say they have no evidence election data was compromised.
- What
- Breach
- Affects
- Berlin state government administrative network (German state administration)
- Fixed in
- Nothing to patch
- Since
- 7 Aug 2026
- Closed
- 16 Oct 2026
Timeline
- Update
The Senate Chancellery said analysis of the stolen data and strengthening of IT protection were continuing, and that criminal prosecution would be pursued. Its page did not say whether affected people had been notified.
- Update
Berlin set up a central crisis unit to review the leaked data and said affected people and businesses would be told by the relevant authorities under German and EU data protection rules.
- Wider attacks
After an auction starting at 30 bitcoin ended without payment, Rhysida published the stolen data on its leak site.
- Wider attacks
After a special Senate session, Governing Mayor Kai Wegner said Berlin was being blackmailed and would not meet the demands. The same day Rhysida listed Berlin on its leak site, claiming 5.79 TB and about 1.44 million files. Those figures are the attackers' claims.
- Update
The attack came to light and the affected departments were disconnected from the state network. The Senate Chancellery says no further attacks hit those sections after 13 August and that the attackers did not gain a lasting foothold.
- Made publicNothing to patch
Berlin's government later said data left its network between 7 and 12 August 2026, with the Senate Department for Mobility, Transport, Climate Protection and the Environment among the affected areas.
Sources
- Wegner and Spranger: Berlin will not give in to blackmailersBerlin Senate · 28 Aug 2026
- Following a cyberattack: immediate threat avertedBerlin Senate Chancellery · 16 Oct 2026
- Berlin confirms data theft after Rhysida ransomware attack claimsBleepingComputer · 31 Aug 2026
- Berlin launches crisis response after hackers publish stolen dataReuters (via The Star) · 6 Sept 2026