Berlin State Government Data Theft and Rhysida Extortion (August 2026)

What happened

Berlin’s government said an attack on its administrative network was discovered in mid-August 2026. The Record reported that officials believe data was taken between 7 and 12 August. On 14 August the state disconnected two Senate departments from the wider state network: urban development, construction and housing, and mobility, transport, climate protection and the environment.

Both departments stayed operational, but staff lost email and internet access and worked by phone, text and fax. Some district offices could not process housing benefit and education and participation assistance applications because they depend on the urban development department’s systems. The state IT provider, ITDZ Berlin, was not affected.

What Berlin confirmed

On 28 August the ransomware group Rhysida listed Berlin on its leak site. On 31 August the city administration confirmed that criminals were trying to extort it. BleepingComputer reports that forensic investigators believe data was taken from the Mobility, Transport, Climate Protection and Environment department. The State Criminal Police Office, the public prosecutor’s office and federal security agencies are investigating.

Governing Mayor Kai Wegner said, “The state of Berlin is being blackmailed,” and that Berlin will not pay. Berlin has not publicly attributed the attack to Rhysida. It has not ruled out that personal or other non-public data was compromised, and the city says the extent of the theft is undetermined.

What the attackers claim

These points come from Rhysida and have not been verified:

• About 5.79 TB, or roughly 1.44 million files, from the administrative network
• Contracts, emails, phone numbers, personnel and payroll files, and 148 IBANs
• Plaintext credentials, password vaults and credentials for senior officials
• Security assessments for Berlin’s water supply and material the group describes as classified
• An auction price of 30 bitcoin and a short countdown before publication

The Record puts the 30 bitcoin price at about $2.3 million.

Elections

Berlin held its House of Representatives election on 20 September. Interior Senator Iris Spranger said the election environment is considered secure and that officials found no evidence election data was compromised.

What this means for residents and partners

Most residents will not need to do anything unless Berlin writes to them. People and companies that had contracts, payroll or correspondence with the affected departments are the likelier targets, and criminals can use stolen contact details for targeted phishing. Messages that claim to come from a Berlin authority about the incident should be checked through the office’s official channels. Our guide to government impersonation scams covers fake authority notices, and the guide to fake invoice and business email scams is useful if you have supplier ties to a public body.

Follow our data breach checklist if you are notified, and read how to spot phishing messages.

This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.