Rhysida Ransomware Hits Berlin — Germany's Capital Under Cyberattack (2026)

What Is This Threat?

In August 2026, the ransomware group Rhysida breached the IT network of the German capital's state government — the Berliner Landesnetz — just weeks before a regional election, stealing sensitive administrative data. Officials confirmed the intrusion and refused to pay the attackers' ransom demand.

This incident is part of a broader trend: German authorities report that state-linked and financially motivated groups increasingly target public administration, using ransomware not just to encrypt systems but to steal and threaten to leak data — a tactic known as double extortion.

Timeline of the Attack

| Date | Event |

|---|---|

| August 7, 2026 | Attackers gain initial access to Berlin's state network |

| August 7–12, 2026 | Data exfiltration takes place undetected |

| August 14, 2026 | Berlin disconnects affected systems from the network |

| August 17, 2026 | Berlin publicly discloses the breach |

| August 28, 2026 | Rhysida posts the stolen data on its dark-web leak site and sets a ransom deadline |

Attackers had roughly a full week inside the network before anyone cut off access — enough time to move laterally and copy large volumes of files undetected.

What Was Stolen

According to the attackers' own leak-site posting:

Approximately 5.79 terabytes of data, spanning roughly 1.44 million files

Personal information on over 12,000 individuals, including email addresses, phone numbers, and IBANs

More than 46,500 contracts, along with emails, passwords, and internal records

Geodata and mapping files from a Berlin senate department

Rhysida demanded a ransom of roughly 30 bitcoin (around $2.3 million) and threatened to auction or publish the data. Berlin's governing mayor stated the city would not pay, calling it blackmail.

How These Attacks Typically Happen

Rhysida and similar ransomware operators generally don't need to "hack" their way in — they log in:

Initial access via compromised VPN credentials without multi-factor authentication, unpatched vulnerabilities (such as Zerologon), or targeted phishing emails

Lateral movement across the internal network to reach file servers and databases

Data exfiltration of as much sensitive data as possible before deploying any encryption

Extortion: threatening to leak or sell the stolen data on a dark-web portal unless a ransom is paid

Publishing a sample or the full dataset if the deadline passes without payment

Why It Matters — Even If You Don't Work for the Government

Breaches like this expose ordinary residents' personal data — names, contact details, and financial identifiers — which fuels follow-on phishing, vishing, and identity theft. Attackers frequently use leaked data from public-sector breaches to make later scam messages look convincing and personalized.

Red Flags Checklist

❌ Unexpected emails, SMS, or calls referencing your dealings with a public authority or city administration

❌ Messages citing accurate personal details (name, address, case number) to appear legitimate after a known breach

❌ Urgent requests to "verify" your identity, bank details, or login credentials by phone or email

❌ Links to portals that don't match official government (.berlin.de, .bund.de) domains

❌ Any request for passwords, full card numbers, or one-time codes