-
A ransomware gang called Rhysida attacked Berlin’s state government network and stole internal files.
-
The group claims it took 5.79 terabytes of data, including personal records tied to over 12,000 people.
-
Berlin’s mayor and interior senator have refused to pay, even with the city’s election coming up soon.
Berlin’s city government has confirmed that hackers broke into its administrative network and stole data. A ransomware group known as Rhysida has claimed the attack.
The gang is now trying to pressure Berlin into paying a ransom. City officials say they will not give in to the demand.
How the Attack Unfolded
Forensic investigators first spotted the breach in August. They found signs that data had quietly left parts of Berlin’s state network. According to officials, the theft targeted the Senate Department for Mobility, Transport, Climate Protection and the Environment. This happened between August 7 and August 12.
Once the department noticed the problem, it acted fast. Workers disconnected the affected systems from the state network on August 14. Investigators then began digging deeper into what happened and how much was taken.
Rhysida stepped forward publicly on August 28. The group listed Berlin on its dark web leak site, a page hackers use to show off stolen data and pressure victims. According to media reports, the gang says it grabbed close to 5.79 terabytes of files, spread across roughly 1.44 million documents. The attackers also claim the stolen files touch the records of more than 12,000 people.
Berlin has confirmed that a theft took place. However, the city has not verified the exact size or content of what Rhysida claims to hold. Investigators say the true scope is still being worked out.
What the Hackers Say They Took
Rhysida’s claims paint a wide picture. The group says the stolen files include government records, legal papers, and financial documents. Human resources files, infrastructure data, health records, and mapping information are also listed among the claims.
The hackers say they found thousands of names, email addresses, and phone numbers inside the data. They also claim to have 148 IBANs, which are international bank account numbers used for transfers. Payroll files and records of administrative offenses reportedly sit in the stolen pile too.
More alleged material includes email archives, database dumps written in SQL, identity documents, and paperwork tied to disciplinary cases. Rhysida also says it holds login credentials, passwords, and access details for internal databases.
Some of the claims raise more serious concerns. The attackers reference documents from Bundesrat committees, a body in Germany’s federal government. They also point to files about handling classified information and safety reviews of Berlin’s water systems. On top of that, the group claims to have taken over 3,200 nondisclosure agreements.
It is worth repeating that these figures come from the hackers, not from Berlin. According to Security Affairs, cybersecurity reporters have treated the 5.79 terabyte figure and the list of stolen categories as unverified claims for now.
Berlin Pushes Back as Election Day Nears
Rhysida tried to squeeze more pressure out of the situation. Reuters reports that the group first put the stolen data up for auction. The starting price was 30 Bitcoin, worth about $77,600 at the time.
Berlin’s leaders responded with a firm no. Governing Mayor Kai Wegner and Interior Senator Iris Spranger both stated that the city will not bow to extortion. Multiple agencies are now investigating the case together. These include the State Criminal Police Office, public prosecutors, and federal security authorities.
The timing makes this attack even more sensitive. Berlin is heading toward its House of Representatives election on September 20. Any hint of interference could shake public trust. Senator Spranger addressed this directly.
According to The Hacker News, she said investigators have found no proof that election data was part of the breach. She added that the technical systems supporting the vote are currently considered secure.
Hungary faced a pre-election security scare after Bellingcat found 795 leaked email-password pairs linked to 12 of 13 ministries. Weak passwords and employees reusing work emails on dating, music, and sports sites exposed the credentials.
Rhysida is not new to this kind of attack. The group has been active since 2023. It has hit organizations across government, healthcare, and education sectors before. This pattern shows a group that mixes data theft with public pressure to force payouts.
For now, the investigation in Berlin continues. City officials have confirmed that a breach happened, but they have not confirmed the full scale of it. Rhysida’s detailed claims remain just that, claims, until independent checks can confirm or deny them. Until then, Berlin’s message stays the same. The city will keep investigating, and it will not pay.
