Hackers Hit Berlin Government With Ransom Demand After Major Data Theft

In mid-August 2026, Berlin's government detected a serious cyberattack on its administrative network. According to DIE WELT and Time.news, the breach initially cut off several Senate departments from key digital services, but officials did not immediately disclose the scale of the data loss or the identity of the attackers.

The hacker group Rhysida is suspected to be behind the attack, as reported by Point.md and Security Affairs. This group has been linked to previous high-profile ransomware incidents. The Berlin administration confirmed that sensitive data may have been stolen, prompting emergency IT measures and disconnecting parts of the network for safety.

The attack was first discovered around August 14, 2026. By August 18, DIE WELT reported that "very sensitive data" had been compromised and the Senate's crisis communication was under scrutiny. Departments remained isolated, and the full extent of the breach was not yet known, according to Time.news.

On August 19 and 20, DIE WELT highlighted that two Senate administrations were still offline, and the mayor tried to reassure the public that the upcoming September elections were not at risk. The disruption affected public services, including applications for permits.

By late August, the hackers' demands became public. As ARD Tagesschau and DIE ZEIT reported on August 28, the attackers demanded a ransom of two million euros or 30 Bitcoin, threatening to release the stolen data if not paid. The mayor confirmed the extortion attempt but insisted that officials would not pay. Multiple outlets, including BBC World and DER SPIEGEL, highlighted the administration's firm stance against giving in to the threat.

On August 29 and 31, more details emerged. Security Affairs and BleepingComputer linked the incident to the Rhysida ransomware gang, reporting the theft of up to 5.79 terabytes of data. Berlin's government, led by Mayor Kai Wegner, reiterated that it would not pay the ransom. Emergency measures continued, with several networks still offline as authorities worked to contain the breach and assess the damage.

As of early September, Berlin's administration is still dealing with the aftermath of the attack. Two key government departments remain disconnected from the city's IT systems, and emergency protocols are in place to protect what remains of the network. The authorities have confirmed the ransom demand and the large-scale data theft, but have not disclosed exactly what information was stolen.

Investigations by the public prosecutor and local police are ongoing, and IT experts are combing through the city's systems to determine the full impact. Officials continue to insist that the upcoming elections are secure and that the city will not pay any ransom to the attackers.

The main questions now are how much sensitive data the attackers managed to steal and whether any of it will be leaked or sold. Investigations are expected to take several months, and Berlin's IT security practices will be under scrutiny. The city also faces the challenge of restoring full digital services without risking further breaches.