Berlin officials declined a demand for 30 Bitcoin after an August cyberattack on the city-state's administrative network, and the Rhysida group then published claimed stolen data on the dark web. Rhysida listed the leak on August 28 under the entry Berlin, Germany, asserting 5.79 terabytes across roughly 1.44 million files including personal data for 12,076 individuals. The alleged release spans administration, legal, credential, infrastructure and national-defense material, prompting Berlin's state government to start a crisis response.

Extortion timeline and leak claim

The city-state confirmed at the end of August that it faced an extortion attempt connected to the August intrusion into municipal administration systems. Authorities would not meet the payment demand. Rhysida then took credit on its leak site on August 28. Investigators are now contending with roughly 1.4 million files described as holding civil-servant personal details, internal infrastructure records and other government data.

What Rhysida says was taken

These inventory figures are the group's assertions and have not been independently verified:

  • Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
  • Personnel and administrative records: more than 5,000 personnel files, more than 5,000 administrative-offence files, plus payroll data and leadership information.
  • Access material: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
  • Government and legal files: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
  • Handling of sensitive state matter: data related to classified-material handling and documents allegedly containing state secrets.
  • Infrastructure focus: vulnerability analyses concerning Berlin's water supply.
  • Identity material: passports and ID cards from personnel records.
  • Other archives: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.

Rhysida also asserted the episode could touch GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements.

Defense planning and CBRN files in scope

Investigative journalist Lars Winkelsdorf drew attention to the case on social media on September 4, 2026, characterizing the disclosure as exceptionally severe. In his summary of the contents, he said the set went beyond LKA investigation-related documents to include national-defense planning, secret federal continuity communications for a worst-case scenario, defense-related companies, and agency emergency plans.

A separate Euronews report noted a folder titled AG CBRN-Rahmenplanung among the published files, where CBRN stands for chemical, biological, radiological and nuclear threats. Public availability of crisis-response concepts, continuity communications and operational threat-planning material would expand the impact from privacy harm to security planning exposure.

Official response

After publication of the stolen data, Berlin's state government announced a crisis response. According to Reuters, city officials said a central crisis unit would coordinate examination, confirmation and evaluation of the leaked information and help notify affected residents and businesses.

Technical background — general double-extortion pattern

This section describes established ransomware practice in general terms, not new specifics about Berlin:

Double-extortion operations typically encrypt local systems while simultaneously copying data outward for later release. A generic leak-site workflow often follows access, internal discovery, bulk collection and staged publication after a payment deadline passes.

Defenders commonly look for unusually large outbound transfers, broad access to file shares and archiving activity with ordinary tools. Illustrative generic checks used in many environments include:


# generic examples only - not Berlin-specific indicators
netstat -tulnp
ps aux --sort=-%mem | head
find /tmp /var/tmp -type f -mtime -7 -ls

Containment practice emphasizes isolated backups, network segmentation, credential resets for exposed accounts, and structured review of any published datasets before notifying affected parties.