“The state of Berlin is being blackmailed.” Governing Mayor Kai Wegner said it after a special Senate session at the Rotes Rathaus, in the English version of his remarks posted on the city’s official portal. The state government now says extortionists are demanding money over the August break-in to its administrative network. It won’t pay.
The same statement added new detail. Forensic teams found more data leaving the systems of the Senate Department for Mobility, Transport, Climate Protection and Environment, between August 7 and August 12, 2026. The Senate Chancellery said investigators are still working out what was taken and how much, and it could not rule out that personal or other non-public data is in the haul.
The department had flagged an outflow on August 7, the Chancellery told reporters who asked. It was disconnected from the network on August 14, a week later.
Berlin has not said how much data was taken. The only numbers in circulation come from the attackers: a leak-site post indexed on August 28 claims 5.79 terabytes and personal information on 12,076 people. As of August 29, neither of the Senate’s two releases offered advice to anyone whose records might be affected.
Rhysida claim
State criminal police, the public prosecutor and federal security agencies are investigating. The Chancellery named no group. Der Spiegel did, reporting on August 28 that Rhysida had claimed the attack, based on an entry on the gang’s darknet leak site and on security sources involved in the response. The Hacker News checked a leak-site monitoring service on August 29 and confirmed that an entry titled “Berlin, Germany” went up on Rhysida’s site the day before.
The entry says the gang scanned 5.79 terabytes and about 1.44 million files. It names the victim only as Berlin, Germany, not the Senate or a department, and gives no ransom figure. Eleven file categories are listed. The biggest, 124,823 maps and geodata files, is part of a group that adds up to roughly a quarter of the claimed file count.
Rhysida has hit other German targets. The monitoring service lists 280 victims as of August 29, nine of them in Germany, among them the Stuttgart city administration in May 2026 and the aid group Welthungerhilfe in June 2025.
How the city described it
Berlin first went public on August 17. Forensic work had shown the state network was compromised, it said, and the two affected departments had been cut off since the previous Friday. At a press conference on August 19, Wegner called the incident serious and said that, on current knowledge, no sensitive data had left the network. Housing benefit applications and payments could not be processed while the departments were offline.
All Senate departments were back online on August 23. Scanning of the network goes on. Interior Senator Iris Spranger said that so far no data has left the areas tied to the September 20 Abgeordnetenhaus election, and her security officers consider the election environment secure. The Chancellery said the state data protection commissioner and the Federal Office for Information Security (BSI) are getting regular updates.
