Berlin Government Hit by Cyberattack and Extortion Attempt
Berlin’s state government has confirmed that hackers are trying to extort the city following a cyberattack on its administrative network. Officials said they will not pay the ransom.
Forensic investigators found that data was stolen from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and August 12, 2026, before the affected systems were isolated on August 14. The exact amount and type of stolen data are still being investigated, and officials have not ruled out the exposure of personal or other non-public information.
The ransomware group Rhysida has claimed responsibility and reportedly offered the stolen data for sale. The attackers claim to have obtained 5.79 TB of data, although Berlin has not independently confirmed that figure. Reports also say the group demanded 30 Bitcoin and threatened to publish the stolen information if Berlin did not pay.
The attack was initially discovered on August 14, after which two Senate departments were disconnected from the state network. Some public services, including housing benefit applications and payments, were temporarily affected. The departments were later reconnected while forensic investigations continued.
Berlin's authorities, including police, prosecutors and federal security agencies, are investigating the incident. Officials also said that the upcoming September 20 Berlin election has not been affected and remains protected against cyberattacks.
Key takeaway: The incident shows how ransomware attacks can move beyond system disruption into data theft and extortion, while the full impact of the Berlin breach is still being assessed.
