A ransom deadline over Berlin's government data
The ransomware group Rhysida is threatening to publish close to six terabytes of data it says it stole from Berlin's state government network unless the city pays a ransom of 30 bitcoin. Rhysida posted the claim to its dark web leak site on August 28, 2026, and gave the government roughly a week to respond. Berlin's leadership has already said no. Governing Mayor Kai Wegner and Interior Senator Iris Spranger said that "the state of Berlin will not submit to extortion," according to The Hacker News.
How the breach unfolded
The intrusion predates the public threat by several weeks. Investigators trace the initial compromise of Berlin's state administrative network to around August 7, 2026, with data exfiltration continuing through roughly August 12. City officials disconnected several affected departments, including housing and environment administration, starting August 14 to contain the damage. Those departments stayed offline for about a week and were reportedly all reconnected by August 23. Rhysida's leak site post on August 28 was the first public confirmation that a ransom demand had followed the intrusion.
What Rhysida claims to hold
Rhysida says it took roughly 5.79 terabytes of data, around 1.44 million files. The group's leak site listing describes contracts, administrative fine records, maps and geodata, email correspondence, phone numbers, passwords, and personal information tied to more than 12,000 individuals. Some secondary reporting adds judicial documents and emergency response plans to that list, but those specifics have not been independently verified by the city and should be treated as Rhysida's own claims rather than confirmed fact. Ransomware groups routinely inflate or dress up what they took to pressure a victim into paying, so the true scope will only be clear once Berlin's own forensic review is complete.
Berlin has confirmed one concrete, verifiable effect: processing of housing benefit applications was disrupted for residents while the affected systems were offline.
An auction, not just a dump
Rhysida's leak site listing frames the stolen data as an auction rather than a straight public dump, meaning a buyer willing to pay could in theory acquire the files privately even if Berlin never pays and the group never publishes them openly. That structure is typical of double-extortion ransomware: the attacker encrypts what it can reach on the way in, then separately monetizes a copy of the data it exfiltrated first, so refusing to pay a decryption fee does not make the second threat, exposure or sale of the stolen files, disappear.
Why the timing matters
Berlin holds a state election on September 20, 2026, less than a month from the ransom deadline. Officials say the systems that handle voting and election administration were not touched by the intrusion, and reporting from The Local and Reuters has not contradicted that. Even so, a ransomware group publicly auctioning government data three weeks before a vote is the kind of coincidence that invites scrutiny, and German security officials and Der Spiegel have both pointed to Rhysida as the attacker behind it.
Who is behind it
Rhysida is a double-extortion ransomware operation that has been active since June 2023, generally believed to run out of Russia or Eastern Europe. It has claimed roughly 280 attacks to date, weighted heavily toward United States targets with additional activity in the United Kingdom, Canada, and Italy. Its playbook, encrypt what you can and threaten to publish what you copied first, is the same one it used against the British Library in 2023, when it demanded 20 bitcoin and, after being refused, published around 500,000 stolen files.
What this means in practice
For Berlin residents, the immediate risk is identity theft and phishing built from real names, phone numbers, and case records if Rhysida follows through on the leak or sells it through its auction listing. For public-sector IT teams elsewhere, the case is a reminder that a ransomware timeline rarely ends when systems come back online. Berlin's affected departments were reconnected by August 23, more than a month after the actual intrusion, and the extortion attempt only became public five days after that. Refusing to pay, as Berlin has, does not make the leak threat go away, and organizations holding citizen data should assume that any period of unexplained downtime in a public agency may still be working through disclosure weeks or months later. The gap between "systems restored" and "public confirmation of what was taken" is exactly where affected residents lose the most time to protect themselves.
