Berlin confirms data theft after Rhysida ransomware attack claims

The Rhysida ransomware gang targeted Berlin's city administration in mid-August 2026, exfiltrating about 5.79 TB of data comprising 1.44 million files. The stolen data includes a wide range of sensitive information such as government documents, legal and financial records, personnel files, credentials, classified government materials, and critical infrastructure security assessments. The attackers publicly listed Berlin on their data leak site and demanded ransom under threat of data publication, citing GDPR violations to increase pressure. Investigations involve the State Criminal Police Office, public prosecutor's office, and federal security agencies. The attack affected multiple Senate departments, which were disconnected from the network to mitigate further damage. The initial infection vector has not been disclosed, though previous Rhysida campaigns involved malicious Teams installers. No compromise of election-related systems was detected.

The attack resulted in significant data theft including sensitive government, legal, financial, and infrastructure-related information. The exposure of plaintext credentials, payment system data, and classified materials poses risks of further exploitation and reputational damage. The extortion attempt threatens public disclosure of stolen data, potentially violating GDPR and causing legal and regulatory consequences. Operational disruption occurred with affected departments disconnected from the network. The incident is under active investigation, and the full extent of the impact remains to be determined.

The Berlin city administration has declined to pay the ransom and has involved law enforcement and federal security agencies to investigate and respond. Affected departments were disconnected from the network to contain the breach. No specific patch or remediation is indicated as the initial attack vector is unknown. Organizations should monitor official advisories for updates and follow incident response best practices tailored to ransomware and data exfiltration events. No urgent patch or fix is currently available or specified.