Breaches · 51 days ago
Berlin said it will not pay after confirming stolen government data in a Rhysida ransomware attack, and the gang has now put the material up for auction with a countdown. The city also said the incident was discovered in mid-August and that investigators are still working to verify what was taken.
Rhysida says it has roughly 5.7 terabytes of data, but Berlin has not confirmed that figure or the contents. The mechanism is simple: once stolen records are copied out of a government network, the group can threaten to leak or sell them even if the victim refuses the ransom, so the harm does not end when the extortion demand is rejected.
For local-government networks, the exposed data can outlive the intrusion and reach people named in the records through fraud, doxxing, or follow-on targeting. The remaining uncertainty is scope, and that matters because the downstream risk follows whatever actually left the network, not the city’s public stance.
5 sources covering this story
Rhysida Publishes Berlin Government Data After €2m Extortion Demand Re
The ransomware group’s published dataset reportedly includes Berlin state employee data, as well as highly sensitive emergency plans
The Record from Recorded Future
Berlin says it won’t pay ransom after hackers steal government data
Governing Mayor Kai Wegner said on Friday that Berlin had received an extortion demand following the cyberattack, which was discovered in mid-August.
Berlin confirms data theft after Rhysida ransomware attack claims
Berlin's city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site.
Berlin Won’t Pay Extortion Group Claiming Data Theft
The Rhysida ransomware group has claimed the exfiltration of over 5TB of data, including personal information and credentials.
Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
Berlin confirms an extortion attempt after data theft from its state network, while the scope of the exfiltrated data remains under review.
Part of the PlainSec briefing for 2026-09-08