Berlin Won’t Pay Extortion Group Claiming Data Theft

In August 2026, the Rhysida ransomware group infiltrated Berlin's Senate Department for Mobility, Transport, Climate Protection, and Environment, exfiltrating more than 5.7 terabytes of data. The stolen data encompasses complaints, legal and financial documents, contracts, human resources files, passwords, and personal information such as passport and ID details, payroll data, and leadership private data. The group demanded a ransom payment of 30 bitcoins (~$2.3 million) but Berlin authorities have refused to pay. The incident led to network shutdowns in affected departments and is under investigation by state and federal law enforcement agencies. The attack highlights the significant impact of ransomware groups leveraging data theft and extortion tactics.

The attack resulted in the theft of a large volume of sensitive data, including personal information of over 12,000 individuals, credentials, financial details, and confidential government documents. This exposure poses risks of identity theft, financial fraud, and potential reputational damage to the affected departments and individuals. The operational impact included network shutdowns to contain the breach, potentially disrupting public services. The refusal to pay ransom may prevent further immediate financial loss but could increase the risk of data exposure if the attackers publish the stolen information.

Berlin authorities have chosen not to pay the ransom and have contained the attack by shutting down affected networks. An ongoing investigation by state criminal police, federal security agencies, and the public prosecutor’s office is in progress. No specific patches or technical mitigations are indicated in the available information. Organizations should monitor official updates from the investigation and follow guidance from law enforcement. No additional mitigation actions are recommended based on the current public information.