State of Berlin

Summary

Berlin officials said hackers compromised city systems and stole data, demanding a ransom of 30 bitcoin worth about €2 million. The Rhysida group claimed responsibility and threatened to auction the stolen 5.79 terabytes of data. Several online services, including housing‑benefit applications, were shut down after the breach. Investigators found additional leaks in the transport and environment departments and warned that personal or non‑public data might be affected. State police, prosecutors and federal security services are investigating the attack with urgency. A state senator confirmed that election infrastructure remained uncompromised.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Thursday evening in mid‑August 2026, Berlin’s mayor Kai Wegner announced that the city was being blackmailed by hackers who had compromised municipal systems and stolen data earlier that month. The ransom demand, which was not disclosed in full by officials, was reported by Der Spiegel to be 30 bitcoin, equivalent to about €2 million. Following the demand, several of the capital’s online services were forced to shut down while investigators began to assess what information had been taken. An initial data leak was identified by city officials as having occurred between 7 and 12 August, and on 14 August two department networks were taken offline, disrupting housing‑benefit applications and payment processing for several days.

The Rhysida group, believed to operate from Russia and eastern Europe, claimed responsibility for the intrusion and posted on its dark‑web site that it intended to begin auctioning 5.79 terabytes of stolen Berlin data in seven days. The group’s site displayed a countdown and listed the types of files it said it possessed, including contracts, non‑disclosure agreements, personnel files, passwords and thousands of personal contact details, with a starting auction price matching the 30 bitcoin ransom. Rhysida has claimed hundreds of attacks since emerging in 2023, notably infiltrating the British Museum’s computer systems in 2023 and publishing visitor, subscriber and staff personal data after the museum refused to pay a ransom. Federal police, state prosecutors and Germany’s domestic security services were said to be investigating the suspected perpetrators with the utmost urgency, while officials examined the content and scope of the compromised data.

Forensic reviews subsequently revealed additional data leaks within Berlin’s transport and environment departments, and authorities warned that personal or other non‑public information could not be ruled out as affected. Despite the attack, state senator Iris Spranger emphasized that election infrastructure remained uncompromised, noting that the upcoming municipal elections were roughly a month away. Mayor Wegner reiterated that Berlin would not accede to the blackmail demand and that the city‑state would continue to work with law‑enforcement agencies to resolve the incident.

Sources

Sources available to members: 1 source.