Cyberattack on Berlin could have wider consequences than previously thought

Berlin: Hacker Group Rhysida Releases Additional Data Package from Leak The hacker group Rhysida has released another data package from its large-scale cyberattack on the Berlin Senate administration. This was announced by the Senate in the capital city on Sunday following the initial leak of stolen information on Friday. Measures taken after the first publication were further refined in some aspects, according to the Senate chancellery. These additional measures could lead to temporary restrictions in the use of specialized procedures within the building authority, which includes processes such as applying for housing benefits. All users will be informed accordingly. The criminal hacking group Rhysida gained unauthorized access to parts of the Berlin state network from August 7th to 12th, 2026, and stole data. Affected were the Senate administrations for Urban Development, Construction, and Housing, as well as for Mobility, Transport, Environment, and Climate Protection. The attack was detected on August 14th, 2026, and made public three days later on August 17th. The hackers demanded two million euros in Bitcoin as ransom, with payment due by Friday. However, the Berlin state government stated it would not be extorted and refused to pay. After the deadline expired on Friday, approximately 1.4 million files were offered for download. Cyberattack on Berlin Could Have Larger Consequences Than Initially Thought There is talk of an “actual data super-disaster” and a data flow of “grave proportions.” The cyberattack on parts of the Berlin administration could have far-reaching consequences beyond the capital, affecting areas previously thought unaffected. Since Friday, around 1.44 million files totaling 5.8 terabytes have been published in the dark web. Initially, it seemed only personal data was affected, including scanned passports, employment contracts, job applications, and sick notes. According to several media reports and assessments by IT experts, however, highly sensitive data might also have been leaked, data relevant to the protection of critical infrastructure and the security of federal and state governments. This includes information related to civil defense or defense-related companies. The attack began long before the dates mentioned, targeting the Senate administrations for urban development, construction, and housing, as well as for mobility, transport, environment, and climate protection. On August 14th, the two administrations were isolated from the state network. By August 17th, the Senate chancellery issued a press release informing the public about an “ICT incident in the Berlin state network,” establishing an emergency crisis team, and involving the Federal Criminal Police Office (BKA) and the State Criminal Police Office (LKA). The Federal Office for Security in Information Technology (BSI) was also informed. By August 21st, the two administrations remained disconnected from the state network, leading to problems with transfer services, notably preventing the payment of housing benefits to 50,000 eligible households in Berlin. On August 24th, all parts of the Senate administration were back online, and according to the mayor, Kai Wegner, the administration was “basically operational.” On August 27th, the state secretary for digitalization, Florian Hauer, stated that the attack had been contained, though he could not rule out that “personal or other non-public data may have been affected.” On August 28th, security authorities met with representatives of the state of Berlin during a crisis meeting. The attackers had stolen data and placed a ransom demand. Mayor Wegner declared, “Berlin does not allow itself to be extorted.” Details about the scope and content of the data were not disclosed. That evening, the magazine Spiegel reported that the notorious ransomware gang “Rhysida” was likely behind the attack. On their dark web website, they presented a demand for 30 bitcoins (around two million euros) along with alleged extracts from the data. They promised lists of plaintext passwords, judicial documents, and over 46,500 contracts from the state. On August 30th, CCC spokesperson Joachim Selzer warned of potential identity theft and other fraud attempts. Citizens whose personal information might be included in the dataset could become victims of extortion attempts. On September 1st, the Senate confirmed that passwords had also been leaked, making it impossible for staff at the two administrations to work remotely. All 12,000 systems in the state of Berlin were currently being checked round-the-clock. On September 4th, the criminals published around 1.44 million files in the dark web, including personnel records, disciplinary proceedings, financial documents, and details about the critical infrastructure of the state of Berlin. On September 5th, the BSI warned of an “increased threat level” for society. It pointed to the possibility of targeted phishing attacks following the data leak. People who had contact with affected individuals or institutions should therefore be particularly vigilant. Possible Hack-and-Leak Operations In particular, there is a risk of so-called hack-and-leak operations in the political sphere, especially ahead of elections. Stolen documents, emails, or similar materials can be published at a time favorable to the attacker, often manipulated into misleading contexts. In Berlin, a new parliament is to be elected on September 20th. According to the BSI, however, there is no indication that the hackers, who infiltrated the databases of the Berlin Senate, pursued a political motive. It is assumed that the act was “exclusively financially motivated.” Information on Critical Infrastructure “The data may contain information about critical infrastructure, companies, and organizations, which depending on the sensitivity of the data could increase the threat level,” warns the BSI. Those affected should check whether they are specifically impacted by the data leak and what kind of data was published, and possibly change procedures accordingly. Mayor Kai Wegner told the newspaper Bild that the city was currently assessing which information had flowed out. The goal was to reach the affected parties as quickly as possible. Wegner had publicly revealed earlier that the city had been extorted after the cyberattack became known two weeks prior. The criminal hacking group Rhysida had demanded a ransom of 30 bitcoins, equivalent to roughly two million euros. The Senate had decided not to pay. 5.8 Terabytes of Data in the Dark Web After the deadline on Friday afternoon, the hackers carried out their threat: a 5.8 terabyte data package was published in the dark web. The group itself stated that it had stolen around 1.44 million individual files. Among these are reportedly more than 5,000 employee records, fine proceedings, and salary statements, as well as confidential documents from federal council committees and analyses of vulnerabilities in the Berlin water supply system. Additionally, the perpetrators boasted of having obtained login credentials and passwords in clear text, for example, for databases of the administration and payment service providers. Whether these claims are accurate remains unclear. “Federal data systems are not affected,” stated a government spokesperson. The federal government is monitoring the information and investigations into the data leak at the state level closely. The involved authorities, including the BSI, the Federal Criminal Police Office, and the Federal Office for the Protection of the Constitution, are continuously cross-checking their information. “After analyzing potential security risks, appropriate measures to safeguard military security will be initiated,” the spokesperson added. “Federal data systems are, as far as current knowledge goes, not affected.”