Berlin Hack: 5.8 Terabytes of Government Data on the Dark Web

In early September 2026 the ransomware group Rhysida published roughly 5.8 terabytes of data from Berlins state network on the dark web, after the Berlin Senate refused to pay the demanded ransom of 30 Bitcoin (around 2 million euros). It is the largest data theft in the history of Berlin’s government administration, and the consequences will likely be felt for years to come.

Timeline of the attack

Between August 7 and 12, 2026, the attackers infiltrated the networks of two Senate departments: the Senate Department for Urban Development, Building and Housing, and the Senate Department for Mobility, Transport, Climate Protection and the Environment. According to the BSI (Germanys federal cybersecurity agency), the initial access was likely gained through an external VPN connection, with fake CAPTCHA prompts used to bypass existing security barriers.

The breach was not discovered until August 14, two days after the actual data exfiltration had ended, at which point both departments were immediately disconnected from the state network. This seven day window between the start of the exfiltration and the isolation is remarkable because it was apparently enough for the attackers to extract 1.44 million files totaling 5.79 terabytes. Berlin did not publicly communicate the incident until August 17, initially describing it as an “ICT security incident” without further details.

The ransom and the publication

On August 28 the ransom demand appeared: 30 Bitcoin, at the time roughly 2 million euros. On their darknet page the attackers wrote “Use the opportunity to bid on exclusive, unique and impressive data. Open your wallet.” Berlins Governing Mayor Kai Wegner and Interior Senator Iris Spranger made their position clear in a joint statement: “The State of Berlin will not allow itself to be blackmailed.”

On September 4, 2026 at 5 PM, after the deadline had expired, Rhysida published the data in three download packages totaling 5.26 terabytes and 1439893 files, accompanied by the message “All files was uploaded to public access, data hunters, enjoy.” The file listings were subsequently shared on social media as well.

What the data contains

The published data encompasses a broad spectrum of administrative documents that, taken together, paint a detailed picture of Berlins government operations. Based on the information from the leak site and the analyses by journalists and security researchers so far, the material includes among other things:

  • Personal data of 12076 individuals, 16389 email addresses, 11963 phone numbers, and 148 IBANs
  • Over 5000 personnel files with employment contracts, performance reviews, payroll records and disciplinary actions
  • 2738 health records and sick leave documentation
  • 5941 files containing passwords, some in plaintext (e.g for GebäudAtlas, ePayment PAYONE, administrative access credentials)
  • 46522 contracts, 77939 legal and complaint files, 55553 financial documents
  • Over 5000 administrative offense records
  • 3226 non-disclosure agreements (NDAs)
  • SQL database dumps spanning 2020 through 2026
  • 124823 cartography and geodata files
  • Scanned identity cards and passports from personnel files

Particularly sensitive is the critical infrastructure area: the data contains vulnerability analyses of Berlins water supply, a folder labeled “AG CBRN-Rahmenplanung” (chemical, biological, radiological and nuclear threat scenario planning) as well as documents related to the Bundeswehr (German armed forces) and to classified federal government communication channels for crisis scenarios. Investigative journalist Lars Winkelsdorf described the situation as being of a “magnitude that threatens state security” and warned that this material could be accessed by terrorists or foreign intelligence services.

Berlins narrative vs. reality

This is where it gets interesting, because the official communication and the actual findings diverge considerably. Digital State Secretary Florian Hauer stated that “only data with the lowest of four classification levels had been stolen”, meaning VS-NfD (restricted, for official use only). Documents with higher classifications were reportedly not affected. Files that initially appeared sensitive, such as documents referencing the Military Counterintelligence Service (MAD), had upon closer examination turned out to be routine administrative documents like parking permits.

At the same time however, journalists found CBRN planning documents, vulnerability analyses of water and power supply systems, and information about Bundeswehr contracts in the published data. Whether Berlin is deliberately downplaying the severity or whether the government is genuinely only grasping the full extent gradually remains an open question. The review of over 1.2 million files was in any case not yet complete at the time of Hauers statement…

Investigation status

The investigation is being conducted jointly by several agencies: the Berlin State Criminal Police Office (LKA), the Berlin Public Prosecutors Office, the Federal Criminal Police Office (BKA), the Federal Office for Information Security (BSI), and the Federal Office for the Protection of the Constitution (BfV). Coordination runs through the Joint Cyber Defense Center.

On September 5 the BSI warned of an “elevated threat level” for society and pointed specifically to risks from identity theft, targeted phishing campaigns, and potential misuse by hostile states or terrorist actors. On September 6 the Senate established a central coordination unit in the Senate Chancellery, led by Chief Digital Officer Florian Hauer, tasked with reviewing, assessing and evaluating the exfiltrated data and contacting affected individuals based on a risk-based prioritization..

Regarding Rhysida itself: the group has been active since May 2023 and has previously attacked the British Library, the Chilean Army and various healthcare institutions among others. They are considered financially motivated and operate on the classic double extortion model where data is first stolen and then encrypted, putting victims under pressure twice. Whether Rhysida is an independent group or a rebrand of an older operation remains subject of ongoing investigations.

Political dimension

The publication falls into a politically sensitive period because the election for the Berlin House of Representatives takes place on September 20 2026. Security experts warn of potential “hack-and-leak operations” where stolen data is strategically released to influence public debates or political processes. Berlin authorities emphasize however that the election infrastructure is not affected.

Green Party politician Konstantin von Notz called it a “data super-catastrophe” and demanded “personnel consequences” if security protocols had been deliberately violated. IT security expert Manuel Atug accused the Berlin administration of “gross negligence” and “willful disregard” of classification regulations, pointing to warnings that had been issued as early as 2023 and 2025. CDU security policy expert Roderich Kiesewetter warned of “grave implications for national security”.

Open questions

There are quite a few questions that still do not have satisfactory answers:

Why were such sensitive data (CBRN plans, infrastructure analyses, Bundeswehr documents) stored on file servers of two Senate departments that are primarily responsible for urban development and transport in the first place? How could a data exfiltration of nearly 6 terabytes over five days go unnoticed? Why did it take another three days after discovery of the breach before the public was informed? And what concrete security measures were implemented following the documented warnings from 2023 and 2025?
Berlin says it has since secured the affected systems, reconnected both Senate departments to the state network and reviewed 12000 systems. Payment systems that had been down in the interim (roughly 50000 households were temporarily unable to receive housing assistance) are operational again.

For affected citizens, employees and companies: anyone who suspects their personal data may be affected can file a report through the Berlin Police online service and should be particularly vigilant against phishing attempts and unusual contact attempts. The coordination unit has announced it will actively contact affected individuals in accordance with GDPR requirements, although without specifying a concrete timeframe…

An attack of this magnitude demonstrates once again that the fundamentals of IT security in public administrations are not optional. If you want to know how your organisation stands against comparable threats: get in touch.

Sources:

Autor: Andriu Isenring CISSP