IT security: Berlin Senate Chancellery: No comment on the blackmailers
On August 29, 2026, Berlin’s Governing Mayor Kai Wegner (CDU) and Interior Senator Iris Spranger (SPD) informed the public about a cyber extortion attempt targeting the city’s administration. The attack, which was revealed on August 14, involved hackers gaining access to sensitive data including records of petty offenses and passwords. While the perpetrators demanded 30 Bitcoin (approximately €2 million), the authorities have not disclosed specific details about the stolen data or the identity of the attackers. The city has maintained silence on these matters due to ongoing investigations, citing 'investigative tactical reasons.' Although initial reports suggested only publicly accessible data had been compromised, the Senate later admitted this was not accurate. The group responsible for the attack, Rhysida, is known for using malware in ransomware campaigns.
A cybercriminal group known as Rhysida has allegedly extorted 30 Bitcoin, worth approximately two million euros, from the Berlin Senate, threatening to release sensitive data if the payment is not made. The ransomware gang claims to have stolen 5.8 terabytes of information, including contracts, administrative records, login credentials, and data related to critical infrastructure and legal matters. The threat comes amid ongoing investigations by German authorities, including the State Criminal Police Office (LKA) in Berlin and federal security agencies. According to reports from heise online and Der Spiegel, the attack was discovered in mid-August, with the Berlin Senate confirming that data exfiltration had been occurring since at least July 7. On August 14, the city’s traffic and building departments were disconnected from the municipal network following the breach. Forensic analysis later revealed additional data leaks within these departments, raising concerns over the potential exposure of both public and private information. The attackers, identified as Rhysida, a well-known ransomware group active since 2023, have previously targeted institutions such as the British National Library. Their modus operandi involves encrypting systems and demanding cryptocurrency payments, with the option of leaking stolen data as leverage. In this case, the group has posted a countdown on its dark web platform, indicating it plans to auction the data beginning seven days from the posting. The ransom demanded matches the starting bid for the auction, suggesting a direct link between the extortion and the sale of the stolen information. Berlin’s governing body has refused to comply with the demands. Regierender Bürgermeister Kai Wegner stated during a special session of the Senate on August 29 that the city “will not be blackmailed.” While he did not specify the nature of the data at risk, he noted that it could include personal information. The city’s stance aligns with broader efforts to resist cyber extortion, as confirmed by multiple media outlets reporting on the situation. The extent of the data breach remains unclear. According to Der Spiegel, the stolen materials include 46,500 contracts, 80,000 administrative proceedings, 6,000 login-related files, and other documents potentially involving critical infrastructure planning, emergency protocols, and judicial affairs. The authenticity and sensitivity of these files are yet to be fully assessed, though preliminary glimpses suggest they could pose significant risks if released publicly. Investigations into the attack are ongoing. Federal and local law enforcement agencies are collaborating to trace the perpetrators, with the focus on identifying the individuals or entities responsible for the breach. The German Federal Criminal Police Office (BKA) and cybersecurity experts are analyzing the technical aspects of the intrusion, aiming to determine whether the attack was part of a larger campaign targeting public sector organizations. The incident highlights growing vulnerabilities in urban digital infrastructure. As cities increasingly rely on interconnected systems for governance, the risk of cyberattacks continues to rise. Berlin’s response underscores a commitment to maintaining operational continuity despite the threat posed by organized cybercrime groups. However, the lack of transparency regarding the exact scope of the breach and the identities of the attackers complicates efforts to prevent future incidents. In the meantime, the city remains under pressure to balance security measures with the need to protect citizens’ privacy. While officials have not disclosed specific details about the stolen data, they have emphasized the seriousness of the situation, reinforcing the importance of robust cybersecurity practices in public administration. The outcome of this case may influence policy decisions and resource allocation for future digital defense strategies in Germany’s capital.
Go to the primary sources (4)
The official sources this coverage is built on. Read them directly to bypass framing.
A major cyberattack has disrupted parts of Berlin's administration, raising concerns ahead of the city's September 20 election. The attack targeted the Berlin state network, which is operated by the ITDZ service center, causing critical systems such as those handling welfare payments and transportation to fail. Interior Senator Iris Spranger (SPD) and Mayor Kai Wegner (CDU) addressed the crisis, emphasizing that sensitive data was not compromised and that electoral systems remained unaffected. However, the incident highlights vulnerabilities in Berlin’s digital infrastructure, particularly since not all municipal departments are connected to the central network. Investigations into the perpetrators are ongoing.
Bias read (Progressive): The article frames the cyberattack as a significant threat to democratic processes, aligning with left-leaning concerns about cybersecurity and governance. It emphasizes the potential risks to elections and criticizes the fragmented nature of Berlin’s IT infrastructure, which could be seen as a left
Why factuality (90): The article accurately reports on a hacker attack on the Berliner Landesnetz, mentioning the disruption of services like welfare payments and election processes. It cites the involvement of the Senate and officials such as Iris Spranger and Kai Wegner, providing specific details about the impact and
Why objectivity (65): The article takes a clear stance by blaming the attack and linking it to potential election interference, using strong language like 'Angriff auf Berlin.' While it provides factual details about the impact, it frames the issue in a political context, potentially influencing reader perception toward
Der SpiegelIndependentCenterFactual 85Objective 90
The article titled 'Berlin: Cyberattack on the Capital – Hackers Demand 30 Bitcoins' appears to be a subscription promotion for SPIEGEL+. The content does not provide any substantive information about a cyberattack or hackers demanding Bitcoin. Instead, it focuses on advertising digital subscriptions, offering pricing options and benefits such as access to articles, digital editions, and archives. There is no mention of a cyberattack event, its impact, or any related security measures.
Bias read (Center): The article does not present a clear ideological frame or slant. It is primarily promotional content focused on subscription services rather than reporting on a specific political issue. While cybersecurity could be considered a politically relevant topic, the article itself does not engage with it,
Why factuality (85): The article provides clear information about the recovery of services after the cyberattack, referencing the date of the incident and the steps taken to restore systems. It is factual and aligns with the primary source regarding the timeline and outcome of the attack.
Why objectivity (90): The article is highly objective, presenting the situation without any emotional language or bias. It simply reports the status of the recovery efforts without commentary.
A cyberattack on Berlin's Senate administration, attributed to the ransomware group 'Rhysida,' has resulted in the theft of over 5.8 terabytes of data. The attackers have demanded 30 Bitcoins (approximately two million euros) in exchange for not releasing the stolen information. According to reports, the group has previously targeted institutions such as the British National Library and the city of Stuttgart using similar tactics. Berlin has refused to pay the ransom, stating it will not yield to extortion. The leaked data reportedly includes contracts, legal documents, login credentials, and sensitive information related to critical infrastructure and emergency plans. The exact nature and sensitivity of the data remain unclear, but authorities have confirmed the breach and are investigating the incident.
Bias read (Center): The article presents the situation objectively, citing multiple sources including the Spiegel and official statements from Berlin's leadership. It does not favor either side in the dispute between the hackers and the city, nor does it exhibit biased language or selective reporting. The framing is un
Why factuality (85): The article accurately reflects the situation as described by the Spiegel, including the threat of data leaks and the involvement of Rhysida. It cites the Spiegel as a source and presents the information in line with the primary document, maintaining consistency with other reports.
Why objectivity (80): The article maintains a neutral tone, focusing on the facts without injecting personal opinion or emotional language. It avoids taking sides in the dispute between the city and the hackers.
Hackers have allegedly extorted the city of Berlin by threatening to release stolen data, demanding 30 bitcoins (approximately two million euros). The Berlin Senate has remained silent on the specifics of the hackers' demands, the nature of the data compromised, and the identity of the perpetrators. According to a report by *Spiegel*, the hacker group Rhysida, known for previous attacks, is suspected of being behind the breach. The attackers reportedly accessed sensitive information, including data from administrative procedures and passwords, though the extent of the breach remains unconfirmed by authorities. Following a special session of the Senate, Mayor Kai Wegner (CDU) and Interior Senator Iris Spranger (SPD) confirmed the cyberattack but provided no further details, emphasizing that Berlin would not yield to extortion.
Bias read (Center): The article presents factual information about a cyberattack on Berlin's administration without overtly favoring any political side. It reports on the situation neutrally, citing official statements and third-party sources like *Spiegel* without apparent ideological framing.
Why factuality (80): This article provides detailed information about the cyberattack, including the involvement of the Rhysida group and the amount demanded. It references the Spiegel report and includes quotes from officials, supporting its factual basis. However, it mentions the Spiegel's report as a source without p
Why objectivity (75): The tone is slightly more critical towards the government’s response, suggesting that they are withholding information. This could be seen as a subtle editorial stance rather than purely objective reporting.
As of August 23, 2026, all Berlin administrative services have been restored after being disrupted by a cyberattack. Two Senate departments, those responsible for urban development, construction, housing, mobility, traffic, climate protection, and environmental affairs, were disconnected from the state network for several days due to security concerns following the attack on August 14. The Senate office stated that measures were taken to enhance IT security, and services previously restricted are now available again. However, some minor disruptions and delays might still occur, and forensic investigations into the incident continue.
Bias read (Center): The article presents a factual update on a cybersecurity incident affecting Berlin's administration without overtly criticizing or praising any political entity. It reports on the situation, the actions taken, and ongoing investigations without taking a clear ideological stance. The tone remains客观 (
Why factuality (75): The article reports accurately on the status of Berlin's Senate administrations after a cyberattack, citing the date of the attack (August 14th) and the services affected. It mentions the isolation of two departments for security reasons and the ongoing forensic investigations. The information align
Why objectivity (85): The article presents the situation in a neutral tone, focusing on facts such as the recovery of services and ongoing investigations. There is no evident bias or emotional language, maintaining a balanced reporting style.
On August 29, 2026, Berlin’s Governing Mayor Kai Wegner (CDU) and Interior Senator Iris Spranger (SPD) informed the public about a cyber extortion attempt targeting the city’s administration. The attack, which was revealed on August 14, involved hackers gaining access to sensitive data including records of petty offenses and passwords. While the perpetrators demanded 30 Bitcoin (approximately €2 million), the authorities have not disclosed specific details about the stolen data or the identity of the attackers. The city has maintained silence on these matters due to ongoing investigations, citing 'investigative tactical reasons.' Although initial reports suggested only publicly accessible data had been compromised, the Senate later admitted this was not accurate. The group responsible for the attack, Rhysida, is known for using malware in ransomware campaigns.
Bias read (Center): The article presents information about a cybercrime affecting public administration without overtly criticizing or praising any political faction. It reports on the actions of officials and the nature of the cyberattack without taking a clear ideological stance. The framing remains neutral, focusing
Why factuality (70): The article confirms the ransom demand and the involvement of the hackers, but lacks specific details about the nature of the data involved or the exact timeline. It relies on reports from other media outlets like the rbb, which may introduce some uncertainty.
Why objectivity (85): The article remains largely neutral, focusing on the confirmation of the ransom demand and the official response. There is no evident bias or emotional language used.
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
Germany
