Extortionists supply the only itemized count of what left Berlin's state network
The Senate says it will not pay and has now dated a second outflow to August 7 through 12. Twenty-two days after that outflow was first reported, it has published nothing for the people whose records went.
The Watch · Security desk
What happened
- Berlin's state government confirmed it is being extorted after the August compromise of the city's state administrative network, and said it will not meet the demands.
- The same statement disclosed further data outflows from the Senate Department for Mobility, Transport, Climate Protection and Environment, with the exfiltration dated between August 7 and August 12, 2026.
- Berlin has published no figure for how much data left, so the attackers' post of August 28 claiming 5.79 terabytes and personal information on 12,076 individuals is the only itemized account.
Why it matters
- Who's exposed exposure Anyone in the claimed 12,076 has no state-issued basis for checking their own exposure and must work from an extortion post nobody has verified.
- Who has to decide decision With the ransom question closed, the live choice for the Senate is whether it produces its own inventory or lets a leak-site manifest that describes a quarter of its own claim stand as the public record.
- What it limits constraint Briefing the state data protection commissioner and the BSI continuously keeps regulators current while giving residents nothing specific to act on, which limits them to generic fraud watching.
- What it sets up precedent Rhysida's run through German public bodies makes another municipal entry likely, and the notification posture Berlin sets now is the one those administrations will be measured against.
Next story · Security · Oct 7
MonsterCloud's owner is charged with passing off purchased ransomware keys as proprietary decryptionConfirmed10 publishers
Two of the dates sit on top of each other. Berlin's forensic work puts the second outflow between August 7 and August 12, 2026 [3]. The affected department reported an outflow on August 7 and was not cut off from the state network until August 14 [6]. The entire dated exfiltration therefore ran and finished inside the interval between the first report and the disconnection [18]. Scope and content are still under examination, and the Senate Chancellery says personal and other non-public data cannot be excluded from what was taken [5].
Since Berlin has published no volume figure, the arithmetic available to a resident is the attackers'. The leak-site post claims 5.79 terabytes across roughly 1.44 million files, an average of about 4 MB per file [25][21]. Its eleven categories cover about a quarter of that file count, some 360,000 files, which leaves on the order of 1.08 million files the post never describes [25][22]. The largest itemized category, 124,823 maps and geodata files, is around a third of the itemized quarter and under nine percent of the whole claim [25][23]. The entry names the victim only as Berlin, Germany, rather than the Senate or any department, and carries no ransom figure [25].
Keep the attribution layers separate. The Senate Chancellery names no group and says state criminal police, the public prosecutor and federal security authorities are investigating [7]. Der Spiegel named Rhysida on August 28, citing the group's darknet leak site and security sources involved in the response [8]. The Hacker News separately confirmed through a monitoring service that an entry titled "Berlin, Germany" landed on that leak site on August 28 [9]. Governing Mayor Kai Wegner, after a special Senate session at the Rotes Rathaus, said the state of Berlin is being blackmailed [2].
The tradecraft on file is familiar. The November 2023 CISA, FBI and MS-ISAC advisory on Rhysida records initial access through valid credentials against external-facing VPN endpoints, notably where multi-factor authentication is not on by default [10][14], through Zerologon (CVE-2020-1472), which Microsoft patched on August 11, 2020, nearly six years before the Berlin window [11][19], and through phishing [12]. The same document's countermeasures are MFA across services, remediation of known exploited vulnerabilities, and segmentation [15]. It also notes reported similarities between the Rhysida operators and Vice Society, tracked by Microsoft as Storm-0832 [20]. The monitoring service counted 280 Rhysida victims as of August 29, nine of them German, including the Stuttgart city administration in May 2026 [16].
Refusing to pay matches the FBI and CISA position, which is that payment neither guarantees recovery nor discourages the next attack [14]. That settles the extortion question but leaves the notification question, which belongs to Berlin alone: 22 days after the department first reported an outflow, the Senate's two releases still carried no guidance for people whose records may be in the data [24][13]. The state data protection commissioner and the BSI are being kept informed on a continuing basis [17], and as of August 29 that commissioner had issued no public statement of her own [17]. Regulators are current while the 12,076 individuals named in the attackers' count [4] are left reading a leak-site post.
What to watch
- Whether Berlin publishes its own volume figure and a notification channel, or lets the attackers' 12,076 stand as the operative count.
- Whether the Berlin data protection commissioner issues a statement or opens proceedings over the notification gap.
- Whether Rhysida publishes the claimed 5.79 terabytes now that the Senate has refused, and whether the file categories hold up.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence62
Perspective Coverage
6 publishers- Builder
- Builder 20%
- Operator
- Operator 68%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Berlin's state government confirmed it is the target of an extortion attempt following the August compromise of the city's state administrative network and said it will not meet the extortionists' demands.
- [2]
"The state of Berlin is being blackmailed," Governing Mayor Kai Wegner said after a special Senate session at the Rotes Rathaus, quoted in the machine-translated English version on Berlin's official city portal.
- [3]
The same statement disclosed that forensic work found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment, with the exfiltration dated between August 7 and August 12, 2026.
- [4]
Berlin has published no figure for how much data left the network; the only itemized account in circulation is the attackers' leak-site post indexed on August 28, which claims 5.79 terabytes of data and personal information on 12,076 individuals.
- [5]
Scope and content are still being examined, and the Senate Chancellery said personal or other non-public data cannot be excluded from what was taken.
- [6]
The department first reported an outflow on August 7, the Senate Chancellery said in response to questions, seven days before it was cut off from the network on August 14.
- [7]
The Senate Chancellery's statement said the state criminal police, the public prosecutor and federal security authorities are investigating the suspected perpetrators, and identified no group behind the attack.
- [8]
Der Spiegel named Rhysida as the group and first reported the attribution on August 28, citing an entry on the group's darknet leak site and security sources involved in the response.
- [9]
The Hacker News confirmed via a leak-site monitoring service on August 29 that an entry titled "Berlin, Germany" was added to Rhysida's leak site on August 28.
- [10]
The joint CISA, FBI and MS-ISAC advisory on Rhysida documents initial access via valid accounts on external-facing remote services, with actors authenticating to internal VPN access points using compromised valid credentials, notably at organizations lacking multi-factor authentication enabled by default.
- [11]
The advisory also lists Zerologon (CVE-2020-1472), an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol that Microsoft patched on August 11, 2020.
- [12]
The agencies record phishing as a successful route into victim networks for Rhysida.
- [13]
The Senate's two releases on the incident carried no guidance for people whose records may be among the data as of August 29.
- [14]
The advisory dates to November 2023 and records that the FBI and CISA do not encourage paying ransom, because payment does not guarantee recovery and may embolden adversaries to target further organizations.
- [15]
The agencies recommend prioritizing remediation of known exploited vulnerabilities, enabling multi-factor authentication across services, and segmenting networks to prevent ransomware spreading.
- [16]
The monitoring service listed 280 Rhysida victims as of August 29, nine of them in Germany, including the Stuttgart city administration in May 2026 and the aid organization Welthungerhilfe in June 2025, plus the Port of Seattle indexed in September 2024.
- [17]
The Senate Chancellery said Berlin's state data protection commissioner and the Federal Office for Information Security are being kept informed on a continuing basis, and The Hacker News found no statement on the incident from the Berlin Commissioner for Data Protection and Freedom of Information as of August 29.
- [18]
The dated exfiltration window of August 7 to August 12 falls entirely inside the August 7 to August 14 interval between the department's first reported outflow and its disconnection from the network.
- [19]
Zerologon had been patched for nearly six years by the time of the Berlin exfiltration window.
- [20]
The advisory notes open-source reporting of similarities between Vice Society, which Microsoft tracks as Storm-0832, and the actors deploying Rhysida, an overlap Check Point set out in 2023.
- [21]
The claimed haul averages about 4 MB per file.
- [22]
The eleven itemized categories cover roughly 360,000 files, leaving about 1.08 million claimed files undescribed by the post.
- [23]
The 124,823 maps and geodata files are about 35 percent of the itemized quarter and about 8.7 percent of the total claimed file count.
- [24]
As of August 29, 22 days had passed since the department's first reported outflow with no published guidance for affected individuals.
- [25]
The leak-site post claims to have scanned 5.79 terabytes of data and around 1.44 million files, identifies the victim only as Berlin, Germany rather than the Senate or any department, contains no ransom figure, and lists eleven file categories, the largest of which is 124,823 maps and geodata files, together accounting for about a quarter of the claimed total file count.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comBerlin confirms data theft after Rhysida ransomware attack claims
1 article · August 31, 2026
- helpnetsecurity.comBerlin refuses to be blackmailed after network breach
1 article · September 1, 2026
- securityaffairs.comRhysida Ransomware Group Targets Berlin Government Ahead of Vote
1 article · August 29, 2026
- securityweek.comBerlin Won’t Pay Extortion Group Claiming Data Theft
1 article · August 31, 2026
- thehackernews.comBerlin Refuses to Pay Hackers Who Stole Data From the City's State Network
2 articles · August 29, 2026
- therecord.mediaBerlin says it won’t pay ransom after hackers steal government data
1 article · August 31, 2026
Topics and entities
Topics
- Ransomware
- Public Sector Cyberattacks
- Data Extortion
Entities
- CVE-2020-1472 (Zerologon)
- Multi-State Information Sharing and Analysis Center
- Federal Office for Information Security
- Rhysida
- Federal Bureau of Investigation
- Senate of Berlin
- CISA