Hackers have published roughly 1.44 million files stolen from Berlin's city government on the dark web, exposing personnel records, infrastructure plans and files related to chemical, biological, radiological and nuclear threat scenarios after officials refused to pay a ransom demand worth about €2 million.
The ransomware group Rhysida claimed it first gained undetected access to Berlin's state network between August 7 and 12, extracting close to 5.7 terabytes of data before deploying encryption across affected systems. The group demanded 30 bitcoin, and when its deadline expired on September 4 without payment, it began releasing the trove on its dark web leak site. Berlin's governing mayor, Kai Wegner, and interior senator Iris Spranger said in a joint statement that the city "will not be blackmailed" and would not negotiate with the attackers.
What was exposed
Researchers who have examined the leaked files reported finding civil servants' birth certificates, staff absence lists, home addresses and phone numbers alongside far more sensitive material: emergency communication protocols for federal crisis response, records tied to water and power infrastructure, prison systems, defense-sector contractors, and a folder devoted to "CBRN" contingency planning — the acronym for chemical, biological, radiological and nuclear threats. Law enforcement investigation files were also among the material published.
Investigative journalist Lars Winkelsdorf, who has tracked the breach, described the leak as "of a magnitude that threatens the state", warning that the exposed emergency plans and threat assessments "could also be viewed by terrorists or foreign intelligence services." Berlin officials said they were still working through the released material to determine whether any of it could pose a direct security risk to critical sites or government personnel.
A group with a long record
Rhysida operates as a ransomware-as-a-service outfit, renting its malware to affiliates who split any ransom proceeds with the group's core operators; researchers have linked it to the Vice Society group that targeted schools and hospitals in 2021. It has claimed responsibility for close to 300 attacks worldwide since emerging in 2023, including the 2023 breach of the British Library, which cost that institution an estimated £6 million to £7 million to rebuild its systems after it likewise refused to pay.
The timing has added political weight to the breach: Berlin holds a state election on September 20, and while officials say the vote's own infrastructure was not touched by the intrusion, the leak has fueled criticism of the city administration's cybersecurity posture just weeks before residents go to the polls. City officials have not said how long a full forensic review of the stolen files will take, but have pledged to notify affected employees and residents individually as the scope of the exposure becomes clearer.
