Rhysida Ransomware Group Claims Massive Berlin Government Breach, Demands $2.3 Million On August 28, 2026, the Rhysida ransomware group posted a claim on its dark web leak site alleging a major breach of Berlin’s state government IT network. The group asserts it exfiltrated 5.79 terabytes of data, encompassing roughly 1.44 million files, including sensitive judicial documents, emergency response plans, and critical infrastructure details. Among the reported haul are 80,000 administrative fine proceedings, 46,500 contracts, and nearly 6,000 files containing login credentials, along with personal data tied to 12,076 individuals. Rhysida is demanding 30 bitcoin (≈$2.3 million) and has set a one-week deadline before threatening to publish the stolen data. Berlin’s Governing Mayor has publicly stated the city will not pay the ransom, aligning with EU and U.S. law enforcement guidance against ransom payments. ### Key Details of the Incident - Who: Rhysida, a ransomware group known for targeting public-sector and healthcare organizations since 2023. - What: A claimed breach of Berlin’s government IT network, with data exfiltration and encryption. - When: The leak site post appeared on August 28, 2026, with a one-week countdown before potential data release. - Where: Berlin, Germany one of the largest ransomware claims against a European government in 2026. - Why: Rhysida’s playbook focuses on high-pressure extortion, leveraging public-sector vulnerabilities, including legacy infrastructure, fragmented IT governance, and political accountability pressures. ### Impact and Regulatory Risks If confirmed, the breach could trigger GDPR and NIS2 compliance obligations, given the mix of personal data and critical infrastructure documents. The reported exposure of login credentials poses an immediate operational risk, potentially enabling further attacks. Berlin’s government has acknowledged a "major cyber incident" but has not validated Rhysida’s claimed figures, a standard gap in early ransomware disclosures. ### Broader Context 2026 has seen a surge in ransomware attacks on public institutions, with Rhysida favoring municipalities, healthcare systems, and government bodies due to their limited negotiating leverage and slower incident response. The Berlin case stands out for its alleged breadth of stolen data, including judicial and infrastructure-related files, which could set a precedent for future government cybersecurity policies. Security researchers expect Rhysida to publish at least a portion of the data if the deadline passes without payment, though forensic reviews may later reveal discrepancies in the claimed volume. The incident is likely to prompt accelerated cybersecurity budget requests across German and EU public-sector organizations.

Cyberattack Disrupts Berlin Government Network, Key Ministries Disconnected Berlin authorities have taken several state ministries including those overseeing climate action and housing offline following a security breach in the city’s government IT network. The incident, confirmed on Monday by the premier’s office, prompted investigators to isolate affected systems as a precaution, though officials have not disclosed whether data was stolen or identified the attackers. The compromised system, BeLa, is a high-speed fiber-optic network operated by ITDZ Berlin, connecting approximately 600 government and public sites across the city-state. While the full operational impact remains unclear, the breach has raised concerns amid broader warnings about escalating cyber threats targeting public institutions. German authorities, including the Berlin public prosecutor’s office, the State Criminal Police Office, and the Federal Office for Information Security (BSI), are leading the investigation. The incident follows recent statements from Interior Minister Alexander Dobrindt, who described hybrid cyber threats as the "shadow wars of the 21st century," emphasizing Germany’s vulnerability despite not being in a conventional conflict. No further details on the breach’s scope or origin have been released, citing ongoing investigative priorities. The disruption underscores growing risks to critical infrastructure and government networks as cyberattacks on public sector targets intensify.