Berlin confirms data theft after Rhysida ransomware attack claims
Berlin confirms data theft after Rhysida ransomware attack claims, with 5.79 TB of data exfiltrated.
Summary
Berlin's city administration has confirmed a ransomware attack by the Rhysida gang, which claims to have exfiltrated 5.79 TB of sensitive data. The city has refused to pay the ransom, and law enforcement agencies are investigating. The attackers are leveraging alleged GDPR violations to pressure the city into payment.
Full text
Berlin confirms data theft after Rhysida ransomware attack claims By Bill Toulas August 31, 2026 09:30 AM 0 Berlin’s city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. The attack was discovered in mid-August, and the threat actor claimed it publicly last Friday, on August 28. Kai Wergner, the Mayor of Berlin, stated that the city will not pay the attacker, and the State Criminal Police Office, the public prosecutor's office, and federal security agencies are now investigating the incident. Rhysida ransomware has been active since mid-2023, targeting healthcare organizations, state governments, education institutes, and critical infrastructure. The threat actor claims to have exfiltrated 5.79 TB of data, comprising approximately 1.44 million files, from Berlin’s administrative network. According to the attacker, they exfiltrated the following types of information: Government, legal, financial, contractual, HR, infrastructure, health, and mapping records. Thousands of names, email addresses, phone numbers, and 148 IBANs. Plaintext credentials, database accounts, payment-system data, password vaults, and credentials belonging to senior officials. Personnel files, payroll information, administrative-offense records, email archives, SQL database dumps, identity documents, and banking information. Documents related to disciplinary proceedings and other named cases. Allegedly classified or sensitive government material, including Bundesrat committee records and information about handling classified documents. Critical-infrastructure security assessments concerning Berlin’s water supply. More than 3,200 documents marked as nondisclosure agreements. The attackers are using GDPR violations as leverage to increase pressure on the Berlin government, giving the victim four days (at the time of writing) to pay before publishing the stolen files. Rhysida ransomware announcementSource: BleepingComputer According to forensic investigators, the threat actor also exfiltrated data from the Senate Department for Mobility, Transport, Climate Protection and the Environment, likely between August 7 and 12. The affected Senate departments were disconnected from the state network on August 14. The announcement notes that the investigation is ongoing and the extent of the data theft has yet to be determined. Senator Iris Spranger said that the officials found no evidence that election data was compromised and that the technical environment supporting the upcoming Berlin House of Representatives election is considered secure. The method of entry Rhysida used in this attack has not been disclosed. In a previous campaign disrupted by Microsoft, the ransomware operators used malicious Teams installers to breach their targets. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Coca-Cola confirms data theft in Fairlife ransomware attackATF confirms “major incident” after recent Qilin breach claimsAccenture confirms breach after hacker offers stolen data for saleFrench tax authority data breach affects 678,000 individualsFrance fines unemployment agency €5 million over data breach