Overview
- City officials discovered the breach on August 14 and immediately cut the affected Senate department networks from Berlin’s state system to stop the intruders and begin forensic work.
- The ransomware group Rhysida has posted a listing saying it exfiltrated about 5.79 terabytes across roughly 1.44 million files that it describes as administrative, personnel, legal and infrastructure records.
- Mayor Kai Wegner and Interior Senator Iris Spranger said the state will not pay the reported ransom and described the incident as an extortion attempt, with media reporting a demand of about 30 Bitcoin.
- State and federal investigators including the Berlin State Criminal Police Office and the public prosecutor’s office are probing the incident while affected agencies remain isolated and some citizen services experienced short disruptions.
- Rhysida has targeted governments since 2023 and uses public leak sites and privacy pressure to force payments, so authorities and residents should watch for disclosed personal data, official notification about GDPR risks, and possible follow‑on fraud or identity misuse.