Massive Cyber Breach: 1.4 Million Berlin Government Files Dumped on the Dark Web Following Ransom Refusal

In a major escalation of cyber-extortion against European state institutions, the notorious Rhysida ransomware group has published approximately 1.44 million stolen files belonging to the Berlin state government. The massive data dump, totaling nearly six terabytes of highly sensitive information, appeared on the dark web after city officials stood firm and refused to pay a €2 million (30 Bitcoin) ransom demand. The fallout from the breach has exposed critical vulnerabilities, spilling heavily classified government blueprints and the personal data of thousands of civil servants onto the public internet. 

The Extortion and Berlin's Stand

The cyberattack originally took place in early August 2026, with forensic investigations tracing the primary data exfiltration to a window between August 7 and August 12. However, the affected systems were not fully severed from the broader network until August 14, a delay that has drawn intense scrutiny from cybersecurity experts. 

On August 28, Rhysida officially claimed responsibility on its Tor-based leak site, setting a one-week countdown for the city to meet its demands or face public exposure. 

The Berlin Senate's response was swift and definitive. Governing Mayor Kai Wegner and Interior Senator Iris Spranger publicly declared that the state would not submit to blackmail. True to their word, the deadline passed on Friday, September 4, prompting the hacker group to release the compromised data into the public domain. 

Inside the 6TB Data Dump

The leaked repository is staggering in both its size and its sensitivity. Cybersecurity researchers analyzing the 5.79 terabytes of data have uncovered a highly damaging trove of infrastructure blueprints, defense strategies and personal records. 

• Critical Infrastructure & Defense: Among the most concerning discoveries are vulnerability analyses concerning Berlin's water supply and power infrastructure. Investigative journalists also uncovered files tied to defense firms and a folder named "AG CBRN-Rahmenplanung," which contains government emergency plans for chemical, biological, radiological and nuclear attacks. Police investigation reports and national defense communications intended for major crises were also swept up in the breach. 

• Government Operations: The hackers leaked plaintext passwords and credentials for various administrative networks, including ePayment databases and building management systems. Prison-related data and tens of thousands of administrative-offense proceedings were also identified in the dump. 

• Personal and Staff Records: The breach heavily impacted Berlin's civil servants. The files contain personal data on over 12,000 individuals, featuring passports, ID cards, birth certificates, payroll data, home addresses, and financial records. Thousands of email addresses and phone numbers have now been exposed to potential identity theft and targeted phishing schemes. 

Investigation and System Recovery

Faced with one of the most significant breaches in the city's history, Berlin's government has mobilized a massive forensic and operational response. The city hired prominent cybersecurity firm CrowdStrike to rigorously inspect its compromised systems, hunt for lingering threats and rebuild network integrity.

They are working in tandem with the state criminal police, federal prosecutors and Germany’s federal cybersecurity agency (BSI) to analyze the leaked files and mitigate the fallout. 

The breach initially forced the isolation of multiple departments, notably the Senate Department for Mobility, Transport, Climate Protection and Environment. While services have gradually been brought back online, the forensic deep-dive continues to uncover the full extent of the vulnerability that allowed Rhysida to bypass security protocols. 

Election Nerves and Broader Implications

The timing of the leak has added immense political pressure. Berlin is slated to elect its state parliament on September 20, less than a month after the breach occurred. While Interior Senator Iris Spranger has reassured the public that election-related systems are entirely isolated and secure, an attack of this magnitude so close to the polls has inevitably raised alarms regarding state preparedness. 

Rhysida, a ransomware-as-a-service (RaaS) operation that emerged in May 2023, has a history of targeting high-profile public entities, including the British Library, the Chilean Army and the city of Columbus, Ohio. Known for exploiting compromised VPN credentials and unpatched vulnerabilities, the group relies on a double-extortion model: stealing the data, encrypting the victim’s systems and then auctioning or leaking the data if demands are not met. 

For Berlin, the immediate crisis of the ransom demand has now evolved into a long-term containment and damage control operation. With critical infrastructure blueprints and the personal data of thousands of civil servants circulating on the dark web, the city faces a grueling battle to secure its systems, protect its employees from exploitation and restore public trust ahead of the upcoming election.