Berlin refuses to pay hackers who stole data from city state network
This digest was compiled by AI from multiple sources — links to the originals are below.
Berlin's state government confirmed it is the target of an extortion attempt after an August compromise of its administrative network and said it will not meet the extortionists' demands. Forensic work found further data outflows from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and August 12, 2026. The attackers claim to have taken 5.79 terabytes of data and personal information on 12,076 individuals.
Key Facts
- Berlin's state government confirmed it will not pay the extortionists who compromised its administrative network in August.
- Forensic work found further data outflows from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and August 12, 2026.
- The attackers' leak-site post claims 5.79 terabytes of data and personal information on 12,076 individuals.
- Der Spiegel named Rhysida as the group behind the attack, citing its darknet leak site and security sources.
- The U.S. CISA, FBI, and MS-ISAC joint advisory documents Rhysida's use of valid accounts on external-facing remote services for initial access.
Extortion Attempt
Berlin's state government confirmed it is the target of an extortion attempt following the August compromise of its state administrative network. The Senate Chancellery said it will not meet the extortionists' demands. Governing Mayor Kai Wegner said after a special Senate session at the Rotes Rathaus, "The state of Berlin is being blackmailed." The state criminal police, the public prosecutor, and federal security authorities are investigating the suspected perpetrators.
Data Exfiltration
Forensic work found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment, dated between August 7 and August 12, 2026. The department first reported an outflow on August 7, seven days before it was cut off from the network on August 14. Berlin has published no figure for how much data left the network. The attackers' leak-site post claims 5.79 terabytes of data and personal information on 12,076 individuals. The Senate's two releases on the incident carried no guidance for people whose records may be among the data as of August 29.
Rhysida Attribution
Der Spiegel named Rhysida as the group behind the attack, citing an entry on the group's darknet leak site and security sources involved in the response. The Hacker News confirmed via a leak-site monitoring service on August 29 that an entry titled "Berlin, Germany" was added to Rhysida's leak site on August 28. The post claims to have scanned 5.79 terabytes of data and around 1.44 million files. Its eleven file categories, the largest of which is 124,823 maps and geodata files, together account for about a quarter of the claimed total file count. The U.S. CISA, FBI, and MS-ISAC joint advisory documents Rhysida's use of valid accounts on external-facing remote services for initial access.
1 source
Berlin refuses to pay hackers who stole data from city state network
