Rhysida Group Leaks Terabytes of Berlin State Administration Data

The Rhysida ransomware group has published a massive cache of stolen data from Berlin's state administration after city officials refused to pay a multimillion-euro ransom. The leak represents the largest data breach in the history of Berlin's state administration, exposing critical government files just weeks before a major election.

Following the Senate's decision not to meet a demand for 30 Bitcoin—valued at approximately €2 million—the hackers released between 5.26 and 5.8 terabytes of data on the dark web. The leak comprises nearly 1.44 million files stolen from the Berlin Senate departments for construction and transport. The data release occurred immediately after a ransom deadline expired on Friday, September 4, 2026, at 3:35 p.m.

Timeline of the Breach

The security failure began in early August, with the actual intrusion occurring between August 7 and August 12, 2026. City officials did not detect the breach until August 14. The subsequent standoff between the city's leadership and the Rhysida group culminated in the September 4 leak. This timeline places the cyberattack and the resulting public exposure shortly before the Berlin House of Representatives elections, scheduled for September 20, 2026.

Security and Infrastructure Risks

The scale of the leak poses severe risks to both individual employees and the city's broader security posture. For staff, the exposure of personal identity information, including banking details and signatures, creates a high risk of identity theft. On a systemic level, the breach of the construction and transport departments exposes sensitive administrative data that could undermine city resilience.

Critics have pointed to the event as a symptom of systemic failure. Thorsten Schleheider, the regional deputy chief of Berlin's police union, stated that the episode demonstrates "years of neglect" and argued that simply instructing staff to update passwords is a "limited and somewhat helpless response" to such a sophisticated intrusion.

Next Steps for the City

Berlin has activated a central crisis unit to manage the fallout of the leak and coordinate the notification of affected individuals. While the city has maintained its policy of not paying ransoms to cybercriminals, the administration now faces the task of auditing the specific contents of the 1.44 million leaked files to determine the full extent of the damage to state security. Officials have not yet confirmed the specific nature of the most sensitive documents released, but the crisis unit remains on high alert as the city approaches its election date.