In August 2026, the ransomware actor Rhysida infiltrated the Berliner Landesnetz (BeLa, administration network), exfiltrated approximately 5.79 terabytes of administrative data, and subsequently published the entire dataset after the Berlin Senate refused to pay a (Around €2 million) ransom demand.

According to the Federal Office for Information Security, the organization was compromised through a ClickFix variant.

Overview In mid-August 2026, attackers gained access to Berlin’s state network, which links around 600 public-sector sites including district offices and senate administrations. Forensic investigations later indicated that data exfiltration occurred between 7 and 12 August 2026, initially undetected. On 14 August, two senate administrations were disconnected from the network as a precaution, disrupting services such as housing benefit applications for several days. On 28 August, Berlin’s Governing Mayor Kai Wegner (CDU) publicly confirmed that the city was being blackmailed by hackers.

Rhysida claimed to have stolen 5.79 terabytes of data from Berlin’s network. Independent analysis of the published dump estimated roughly 1.44 million files, with the leak site’s own catalog listing 5.26 terabytes across 1,439,893 files. The exposed material included: Over 5,000 personnel files, including health and severe-disability records Plaintext credentials for administrative and payment systems (e.g., PAYONE ePayment database) Passports, ID documents, and leadership data (IBANs, bank cards) Bundestag/Bundesrat committee protocols with declassification correspondence Civil protection (KatSchutz) and CBRN planning documents KRITIS-relevant vulnerability analyses, including Berlin’s water supply Legal, financial, contracts, HR, and infrastructure documents Thousands of email addresses, phone numbers, and contact records

Timeline 7–12 August 2026: Initial data theft from the Berliner Landesnetz. 14 August 2026: Two senate administrations disconnected from the network; external email and internet access temporarily lost for affected offices. 23 August 2026: Mayor Wegner announced that all senate administrations were reconnected and broadly operational again. 28 August 2026: Wegner publicly confirmed extortion; Rhysida claimed responsibility and announced a seven-day auction deadline for the stolen data. Early September 2026: After the deadline expired, Rhysida published the full dataset (circa 5.79 TB / ~1.44 million files) on its darknet leak site.

Suspect Rhysida is a ransomware-as-a-service (RaaS) group active since at least May 2023, known for “double extortion” tactics: stealing data first, then encrypting systems and demanding payment both for decryption and to prevent publication. The group is believed to operate from Russia and Eastern Europe and has targeted healthcare, education, critical infrastructure, and government entities worldwide. Notable prior victims include the British Library (2023), where around 600 gigabytes of internal data were stolen and later leaked after the institution refused to pay.

Impact and response Berlin established a task force led by the State Commissioner for Information Security, with support from the Berlin State Criminal Police Office, the public prosecutor, and the Federal Office for Information Security (BSI). Authorities emphasized that the state would not pay the ransom, aligning with longstanding BSI and BKA guidance against ransomware payments. Following publication, Berlin’s security authorities and commissioned forensics teams began reviewing the data; affected individuals are to be notified on a risk basis, and citizens are advised to file criminal complaints if they detect misuse of their data.

References