Rhysida Ransomware Group Claims Massive Berlin Government Breach, Demands $2.3 Million On August 28, 2026, the Rhysida ransomware group posted a claim on its dark web leak site alleging a major breach of Berlin’s state government IT network. The group asserts it exfiltrated 5.79 terabytes of data, encompassing roughly 1.44 million files, including sensitive judicial documents, emergency response plans, and critical infrastructure details. Among the reported haul are 80,000 administrative fine proceedings, 46,500 contracts, and nearly 6,000 files containing login credentials, along with personal data tied to 12,076 individuals. Rhysida is demanding 30 bitcoin (≈$2.3 million) and has set a one-week deadline before threatening to publish the stolen data. Berlin’s Governing Mayor has publicly stated the city will not pay the ransom, aligning with EU and U.S. law enforcement guidance against ransom payments. ### Key Details of the Incident - Who: Rhysida, a ransomware group known for targeting public-sector and healthcare organizations since 2023. - What: A claimed breach of Berlin’s government IT network, with data exfiltration and encryption. - When: The leak site post appeared on August 28, 2026, with a one-week countdown before potential data release. - Where: Berlin, Germany one of the largest ransomware claims against a European government in 2026. - Why: Rhysida’s playbook focuses on high-pressure extortion, leveraging public-sector vulnerabilities, including legacy infrastructure, fragmented IT governance, and political accountability pressures. ### Impact and Regulatory Risks If confirmed, the breach could trigger GDPR and NIS2 compliance obligations, given the mix of personal data and critical infrastructure documents. The reported exposure of login credentials poses an immediate operational risk, potentially enabling further attacks. Berlin’s government has acknowledged a "major cyber incident" but has not validated Rhysida’s claimed figures, a standard gap in early ransomware disclosures. ### Broader Context 2026 has seen a surge in ransomware attacks on public institutions, with Rhysida favoring municipalities, healthcare systems, and government bodies due to their limited negotiating leverage and slower incident response. The Berlin case stands out for its alleged breadth of stolen data, including judicial and infrastructure-related files, which could set a precedent for future government cybersecurity policies. Security researchers expect Rhysida to publish at least a portion of the data if the deadline passes without payment, though forensic reviews may later reveal discrepancies in the claimed volume. The incident is likely to prompt accelerated cybersecurity budget requests across German and EU public-sector organizations.