Rhysida gang claims theft of 5.79TB from Berlin's city government

Key points

• Berlin's city administration confirmed on 28 August 2026 that the Rhysida ransomware gang is trying to extort it after listing the city on its leak site.
• The attackers claim they stole 5.79 terabytes of data, roughly 1.44 million files, including credentials belonging to senior officials.
• Mayor Kai Wergner said Berlin will not pay, and German federal and state police are investigating.
• Forensic investigators say data was taken from the Senate Department for Mobility, Transport and the Environment between about 7 and 12 August 2026.
• Senator Iris Spranger said there is no sign that data for the upcoming Berlin House of Representatives election was touched.

Berlin's city government has confirmed it's the target of an extortion attempt by Rhysida, a ransomware gang active since mid-2023 that targets hospitals, schools, government bodies and critical infrastructure. Ransomware is malicious software that scrambles a victim's files, though these days the gangs mostly steal data and threaten to publish it unless they're paid.

The intrusion was spotted in mid-August. Rhysida went public on 28 August, posting Berlin on the dark-web site it uses to name victims, as first reported by BleepingComputer. We covered the city's initial refusal to pay in our 28 August story on the breach.

Mayor Kai Wergner has said flatly that Berlin won't pay. The state criminal police, the public prosecutor's office and federal security agencies are all now involved.

What did the hackers actually take?

Rhysida claims 5.79 terabytes, around 1.44 million documents. The gang's own inventory reads like a tour of a city hall's filing cabinets.

It includes personnel files, payroll, email archives and scanned identity documents, alongside 148 IBANs (the account numbers used for European bank transfers). There are also plaintext passwords and payment-system data belonging to senior officials. Plaintext means the passwords were stored as readable text rather than scrambled: exactly what a defender doesn't want to hear.

More worrying for anyone who lives in Berlin: the attackers say the haul contains security assessments for the city's water supply, records from Bundesrat (the federal council) committees, and more than 3,200 documents marked as non-disclosure agreements.

Investigators believe the theft from the relevant Senate department happened between 7 and 12 August. The affected departments were pulled off the state network on 14 August to contain the damage.

Should Berlin residents be worried?

Probably a little, but not about the September election. Iris Spranger, the senator responsible, said officials found no sign that election-related data was affected, and the systems supporting the Berlin House of Representatives vote are considered secure.

For ordinary residents, the practical risk is the usual one after a big government breach: scam emails, fake phone calls and convincing-looking letters that use real personal details. If your name, address or bank details sat in a Berlin administrative system, treat any surprise message about tax, fines or benefits with suspicion and check by calling the relevant office directly.

How did Rhysida get in?

Berlin hasn't said. Rhysida isn't fussy about entry routes. In an earlier campaign disrupted by Microsoft, the gang used booby-trapped Teams installers to trick staff into running malware.

The attackers gave Berlin four days to pay before publishing everything, pointing to Europe's GDPR privacy rules as extra use: leaked personal data means regulatory fines on top of the operational mess. Berlin's answer, so far, is no. That refusal is the right call, and it's also the harder one to hold when water-supply security assessments are sitting on a criminal's server.