Berlin authorities are investigating a cyberattack on the city’s administrative networks after the ransomware group Rhysida claimed responsibility and demanded 30 Bitcoin for stolen data. Officials have stated that the state will not pay the ransom.
The group has threatened to publish or auction approximately 5.8 terabytes of material if the demand is not met. The stolen data is said to include contracts, administrative records, emails, login credentials, and other sensitive information.
The Drivers of This Development
The incident began with unauthorized access and data exfiltration from Berlin Senate administration systems in early to mid-August 2026. Rhysida, a ransomware group known for previous high-profile attacks, later posted details on its darknet site and set a countdown for auctioning the material at a starting price of 30 Bitcoin, valued at roughly two million euros. City officials confirmed receipt of a ransom demand and launched investigations involving the Berlin State Criminal Police Office, the public prosecutor’s office, and federal security authorities. Mayor Kai Wegner and Interior Senator Iris Spranger publicly rejected any payment, emphasizing that Berlin would not submit to extortion. For perspective, the timing occurs weeks before the city-state’s elections on September 20, though officials have stated that election infrastructure was not affected.
It is important to note the fundamental difference between a disruptive ransomware encryption attack and a pure data-theft extortion: in this case the primary leverage appears to be the threat of public release or sale of the exfiltrated files rather than locked systems alone.
Impact and Broader Context
Parts of the city’s networks were taken offline during the response, temporarily affecting certain administrative services. Forensic work continues to determine the full scope of compromised data. The refusal to pay aligns with a common public-sector stance aimed at discouraging future attacks, though it carries the risk that the group may follow through on its threat to release the material.
This development sparks important discussions about the resilience of municipal IT systems and the challenges of defending against sophisticated ransomware groups. Supporters of the no-payment policy argue that yielding would incentivize further attacks on public institutions. Critics or security observers note that large data breaches can still cause lasting harm through identity exposure, operational disruption, and loss of public trust even when ransoms are refused. Analysts observe that Rhysida’s targeting of government entities fits a broader pattern of ransomware groups shifting toward high-visibility public-sector victims to maximize pressure.
Looking ahead, the outcome of the investigation, any data releases by the group, and subsequent security upgrades will shape both the immediate fallout and longer-term lessons for German municipal cybersecurity. This analysis is based on official statements from Berlin authorities and contemporaneous reporting for accuracy and reliability. The full extent of the breach and any further actions by the attackers remain subject to ongoing investigation.