Rhysida Ransomware Attack: 1.44M Files Leaked

The Rhysida ransomware attack on Berlin's state government resulted in the publication of approximately 1.44 million stolen files, comprising nearly six terabytes of sensitive information. The hackers released the data on the dark web after city authorities refused to meet a ransom demand of 30 Bitcoin, reportedly valued at around €2 million. The Berlin data breach exposed government records, personal information and potentially sensitive infrastructure documents, raising serious concerns about cybersecurity across European public institutions.

Rhysida Ransomware Attack: Berlin Refuses €2 Million Demand

The cyberattack originally took place in early August 2026, with forensic investigations tracing the primary data exfiltration to a window between August 7 and August 12. However, the affected systems were not fully severed from the broader network until August 14, a delay that has drawn intense scrutiny from cybersecurity experts. 

On August 28, Rhysida officially claimed responsibility on its Tor-based leak site, setting a one-week countdown for the city to meet its demands or face public exposure. 

The Berlin Senate's response was swift and definitive. Governing Mayor Kai Wegner and Interior Senator Iris Spranger publicly declared that the state would not submit to blackmail. True to their word, the deadline passed on Friday, September 4, prompting the hacker group to release the compromised data into the public domain. 

Inside the 6TB Data Dump

The leaked repository is staggering in both its size and its sensitivity. Cybersecurity researchers analyzing the 5.79 terabytes of data have uncovered a highly damaging trove of infrastructure blueprints, defense strategies and personal records. 

• Critical Infrastructure & Defense: Among the most concerning discoveries are vulnerability analyses concerning Berlin's water supply and power infrastructure. Investigative journalists also uncovered files tied to defense firms and a folder named "AG CBRN-Rahmenplanung," which contains government emergency plans for chemical, biological, radiological and nuclear attacks. Police investigation reports and national defense communications intended for major crises were also swept up in the breach. 

• Government Operations: The hackers leaked plaintext passwords and credentials for various administrative networks, including ePayment databases and building management systems. Prison-related data and tens of thousands of administrative-offense proceedings were also identified in the dump. 

• Personal and Staff Records: The breach heavily impacted Berlin's civil servants. The files contain personal data on over 12,000 individuals, featuring passports, ID cards, birth certificates, payroll data, home addresses, and financial records. Thousands of email addresses and phone numbers have now been exposed to potential identity theft and targeted phishing schemes. 

Investigation and System Recovery

Faced with one of the most significant breaches in the city's history, Berlin's government has mobilized a massive forensic and operational response. The city hired prominent cybersecurity firm CrowdStrike to rigorously inspect its compromised systems, hunt for lingering threats and rebuild network integrity.

They are working in tandem with the state criminal police, federal prosecutors and Germany’s federal cybersecurity agency (BSI) to analyze the leaked files and mitigate the fallout. 

The breach initially forced the isolation of multiple departments, notably the Senate Department for Mobility, Transport, Climate Protection and Environment. While services have gradually been brought back online, the forensic deep-dive continues to uncover the full extent of the vulnerability that allowed Rhysida to bypass security protocols. 

Election Nerves and Broader Implications

The timing of the leak has added immense political pressure. Berlin is slated to elect its state parliament on September 20, less than a month after the breach occurred. While Interior Senator Iris Spranger has reassured the public that election-related systems are entirely isolated and secure, an attack of this magnitude so close to the polls has inevitably raised alarms regarding state preparedness. 

Rhysida, a ransomware-as-a-service (RaaS) operation that emerged in May 2023, has a history of targeting high-profile public entities, including the British Library, the Chilean Army and the city of Columbus, Ohio. Known for exploiting compromised VPN credentials and unpatched vulnerabilities, the group relies on a double-extortion model: stealing the data, encrypting the victim’s systems and then auctioning or leaking the data if demands are not met. 

For Berlin, the immediate crisis of the ransom demand has now evolved into a long-term containment and damage control operation. With critical infrastructure blueprints and the personal data of thousands of civil servants circulating on the dark web, the city faces a grueling battle to secure its systems, protect its employees from exploitation and restore public trust ahead of the upcoming election.