Berlin's city-state government has confirmed a large-scale data theft and extortion campaign against two of its Senate departments, and Governing Mayor Kai Wegner has publicly refused the attackers' demand for 30 bitcoin (roughly €2 million, or about $2.3 million). Reporting on the volume differs slightly depending on who is counting: the figure circulating in German coverage of the city's own assessment is 5.79 TB, while Hive Security and The Hack Academy both record the Rhysida group's own claim as 5.7 TB, and Hive Security cautions explicitly that the number "remains an attacker claim, not a verified inventory." Deutsche Welle reports that roughly 1.4 million records were subsequently published on the dark web after the extortion deadline passed. One structural caveat up front: despite the incident being framed as ransomware, none of the available reporting describes file encryption or ransomware deployment. What is documented is exfiltration followed by leak-site extortion.
What Happened
The timeline is reasonably consistent across sources, with one meaningful divergence. Berlin's investigation places the relevant data exfiltration between 7 and 12 August 2026, a window cited by heise online, The Hack Academy, and Hive Security alike. Deutsche Welle instead gives 7 to 14 August for the period of undetected access. heise adds that the intrusion itself "began long before" the exfiltration window, which would reconcile the accounts if DW is describing dwell time rather than data movement.
On 14 August, the two affected bodies were isolated from the Landesnetz, Berlin's state network. The Record reported on 18 August that the Senate Chancellery had confirmed the disconnection as a precaution, declining at that stage to say who was responsible, how access was gained, or whether data had been taken: "For investigative reasons, no further specific information about the scope or background can currently be provided." Public confirmation of the compromise came on 17 August, with the BKA and LKA investigating and the BSI notified.
The operational fallout was immediate. Both departments stayed online as organisations but staff lost email and internet access, falling back to telephone, SMS and fax, according to RBB reporting relayed by The Record. heise online reports that by 21 August the disconnection had blocked transfer payments including housing benefit for 50,000 eligible Berlin households. The departments were reconnected over the weekend of 22 to 24 August, with heise citing 24 August and The Hack Academy describing the weekend ending 23 August.
Extortion surfaced later. The Hack Academy reports Berlin confirmed an extortion attempt on 28 August and said it would not submit; on 3 September the state reported that a group calling itself Rhysida claimed to hold the data. On 4 September Berlin said the material had been released after the deadline expired. A second package followed during the night ending 6 September, this one containing login credentials, prompting a fresh investigation covered by The Record on 7 September.
What Was Taken
The most authoritative description of content comes from Berlin's data protection authority, as relayed by The Record. The regulator confirmed that the leak includes personal information about public employees and said data belonging to Berlin residents may also have been exposed. The listed categories are broad: names, addresses, dates of birth, bank information, email addresses, telephone numbers, correspondence with government agencies, and copies of documents submitted to the administration.
Deutsche Welle's account of what has actually appeared on the dark web since early September matches that profile closely: employee files, official correspondence, pay stubs, and scanned identity documents.
Counts remain unsettled. DW puts the published set at approximately 1.4 million records. The Hack Academy notes that as of 8 September authorities had not finalised the file count, established how many people were affected, or confirmed whether the published credentials were current, valid or misused. In the same dpa report, Berlin's Chief Digital Officer Florian Hauer said the continuing review had not identified higher-sensitivity or nationally important information among the published material, describing that assessment as preliminary.
Two bodies are in scope, and both are state rather than federal: the Senate Department for Urban Development, Building and Housing, and the Senate Department for Mobility, Transport, Climate Protection and the Environment. The Hack Academy is explicit on this point. Berlin's state-owned IT service provider, ITDZ Berlin, was not affected, per RBB, because the two departments run their slice of the state network independently of it.
Why It Matters
The decision not to pay is the strategically interesting part. Wegner's position, as quoted by DW, was unambiguous: "The State of Berlin will not give in to blackmail." He separately characterised the incident as "a very serious crime committed against the State of Berlin." Berlin accepted full publication as the price of that stance, which is the correct policy calculus and also a demonstration that the calculus has real costs. Hive Security's framing is the one defenders should internalise: disconnecting an attacker ends access, but it does not recall the files already taken. The containment phase ended in August. The exposure phase is open-ended.
The credential dump raises the stakes beyond privacy harm. Berlin's government said the newly released data includes login credentials but did not specify what systems they unlock or whether they remain valid, per The Record. Published credentials from a government network are a standing invitation for opportunistic reuse by actors entirely unconnected to Rhysida, including credential stuffing against adjacent state and district systems.
The political timing is contested in the sources. S1 places the attack roughly a month before local elections and cites state senator Iris Spranger saying election infrastructure remains secure; DW frames the leak as landing shortly before Berlin's state parliamentary election and notes it was overshadowed by the Saxony-Anhalt state election on 6 September. No source alleges any impact on electoral systems.
Finally, the structural diagnosis from heise online's Falk Steiner deserves attention because it generalises. Berlin's city-state structure left each of twelve districts and each Senate department running independent IT administrations, a pattern only half-heartedly modernised over decades. Steiner is careful not to make this a uniquely Berlin failing: a phishing victim can exist in any organisation. But he flags plaintext password collections as genuinely bad practice, and notes they are "encountered more often than any security-conscious person would like." That is an opinion piece, and should be read as informed commentary rather than confirmed forensic finding.
The Attack Technique
The initial access vector was unknown for weeks. Hive Security, writing on 7 September, stated plainly that no public evidence then established the initial access vector, the full content of the released material, or any nation-state involvement. That gap has since been filled.
heise online reports that the BSI has warned of an attack campaign it calls "TerminalFix," referencing an analysis by Microsoft, and confirmed on Mastodon that TerminalFix was the vector used by Rhysida against the Berlin Senate administrations for Building and Transport. The chain described is phishing, followed by a fake captcha, followed by a terminal command executed by the user. That is the ClickFix pattern: social engineering that convinces a human to paste and run an attacker-supplied command themselves, sidestepping email attachment and macro controls entirely because nothing malicious ever transits the gateway.
DW's account is consistent at the human level: an employee unknowingly opened a phishing email. Note that the BSI's confirmation of TerminalFix appeared on Mastodon and is not present in the BSI's own published security notice, per heise. Attribution of the group itself is more settled than the vector was. Rhysida has a track record against government institutions and private firms, and DW describes it as a cybercrime group believed to originate in Eastern Europe. S1 notes the group's pattern of threatening to auction stolen data after a countdown, comparable to its 2023 British Museum breach. DW is explicit that this was criminal rather than foreign intelligence activity.
What Organizations Should Do
- Treat ClickFix and TerminalFix as a live, unpatched-by-design vector. No gateway filter catches a command the user pastes into their own terminal or Run dialog. Review the BSI's advisory and Microsoft's analysis, then close the execution path: constrain PowerShell and shell access for non-administrative users, alert on clipboard-sourced command execution, and run awareness training that specifically shows staff a fake captcha asking them to press Win+R.
- Rotate every credential in scope, not just the ones you can prove were taken. Berlin still cannot say whether the published credentials are current or valid. That uncertainty is the argument for wholesale rotation, forced reauthentication, and session invalidation across the affected estate, plus phishing-resistant MFA on anything reachable from outside.
- Hunt for plaintext credential stores before an attacker does. The plaintext password collections flagged in heise's commentary are what turn one phished mailbox into 5.7 TB. Sweep file shares, ticketing systems, scripts and wikis for stored secrets and move them into a managed vault.
- Assume exfiltration precedes detection, and instrument accordingly. Berlin's data left between 7 and 12 August; isolation came on the 14th, and further exfiltration in the mobility department was only identified on 26 August. Egress volume monitoring and DLP on bulk document access buy days that firewall rules do not.
- Segment so that isolation is survivable. Cutting two departments off the state network was the right call and it cost 50,000 households their housing benefit payments. Map which citizen-facing services depend on which internal systems now, and build manual or failover continuity procedures for the ones that cannot tolerate a two-week disconnection.
- Stand up victim notification and fraud monitoring as a distinct workstream. Berlin created an additional task force purely to review leaked material and identify who is affected, and said identifiable victims would be contacted on a risk basis. With bank details, dates of birth and scanned ID documents in the wild, downstream identity fraud is a multi-year exposure, not an incident-week task.
Sources: Berlin Mayor Stands Against Ransom Demand After Large‑Scale Hack | Berlin investigates new data leak after hackers publish stolen logi... | Berlin cuts two state ministries off government network after secur... | BSI explains first attack vector on Berlin authorities heise online | Exploited a loophole: What favored the Rhysida attack in Berlin he... | Cyberattack in Berlin: 1.4 million files on the Dark Web | Rhysida Published Berlin's Stolen Data. The Incident Is Only Starti... | Berlin state data leak: credentials published in new package