Berlin hit by ransomware attack; Rhysida group claims 5.79 terabyte data theft
Berlin's government is refusing to pay a ransom after hackers compromised multiple city departments and stole roughly 5.79 terabytes of data, Mayor Kai Wegner said on Friday. The German capital's authorities are bracing for the data to be auctioned on the dark web within a week, a little over a month before the city holds elections.
By Source Reporters Newsdesk
Sat, 29 August 2026 · 2 min read
Berlin's government is refusing to pay a ransom after hackers compromised multiple city departments and stole roughly 5.79 terabytes of data, Mayor Kai Wegner said on Friday. The German capital's authorities are bracing for the data to be auctioned on the dark web within a week, a little over a month before the city holds elections.
According to the BBC, citing German magazine Der Spiegel, the attackers are demanding 30 bitcoin — worth about €2m (£1.7m) — and the Rhysida ransomware group has claimed responsibility. Wegner said state police, prosecutors and federal security services were investigating "with the utmost urgency," and warned: "Berlin will not be blackmailed."
The breach unfolded in stages. Officials said an initial data leak occurred between 7 and 12 August, before two department networks were shut down on 14 August, halting housing-benefit applications and payments for several days. Forensic investigations have since uncovered further leaks within Berlin's transport and environment department, and Wegner's office said it "cannot be ruled out that personal or other non-public data may also be affected."
The Rhysida group, which researchers say emerged in 2023 and is believed to operate from Russia and Eastern Europe, has previously claimed hundreds of attacks on governments and businesses worldwide. The group is best known for infiltrating the British Museum's computer systems in 2023, stealing around 500,000 files that were later published on the dark web after the London institution refused to pay.
Der Spiegel reported that Rhysida's dark-web site is displaying a countdown, after which it plans to begin auctioning the Berlin data — including contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details — with a starting price of 30 bitcoin. State senator Iris Spranger said election infrastructure had not been compromised, but the attack lands weeks before Berliners go to the polls.
**Sources:** BBC
Source Reporters corrects errors promptly. Spotted something wrong? Tell us — read our editorial standards and corrections policy.