Loading story…
The Rhysida ransomware group published data stolen from two Berlin Senate administrations after the state government refused its 30 BTC extortion demand. The group claimed to have exfiltrated 5.79 TB of material and initially offered it for auction; the released archive appears to include active file shares and mailboxes containing personnel, legal, identity, payroll, planning, certificate, credential, and infrastructure documentation. Berlin detected data exfiltration between August 7 and 12, disconnected affected departments on August 14, restored connectivity on August 23, and confirmed the public release on September 4.
Berlin has activated a central crisis unit to verify the archive, assess impacts, and notify affected citizens and businesses under German and European data-protection requirements. Officials reported no evidence that material carrying higher national-security classifications was released, but more than 1.2 million files still require review. The exposure creates sustained risks of identity fraud, targeted phishing, credential reuse, and further intrusion; the initial access vector and any political motive remain unconfirmed, with the incident currently assessed as financially motivated extortion.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
After Berlin refused payment, Rhysida made the stolen archive publicly accessible on its dark-web leak site. The listing catalogued 1,439,893 files and 5.26 TB of data, while the group claimed it had stolen 5.79 TB.
Berlin reconnected the affected departments to its network after the containment period.
Berlin disconnected the two affected departments from its network as part of containment actions following the confirmed data outflow.
Berlin confirmed that data was exfiltrated from the Senate administrations responsible for transport, climate/environment, and urban development/housing between August 7 and 12. The incident involved bulk collection of network file shares and mailboxes.
Berlin's state government launched a major review and established a central crisis unit to verify and assess the leaked material, identify affected people and businesses, and coordinate notifications. Officials reported no released material with higher national-security classifications, but continued examining more than 1.2 million files.
Rhysida demanded 30 BTC, reported as approximately €2 million, for data stolen from Berlin. Berlin publicly refused to pay the demand or the group's proposed auction price.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Berlin’s public administration detected a cyberattack on its state network in mid-August after suspected data exfiltration that investigators believe occurred between 7 and 12 August. The intrusion may have begun at least a week before discovery; Berlin temporarily isolated the Senate departments responsible for transport and for construction and housing, then reconnected all Senate departments while forensic work continued. The Berlin LKA, public prosecutors, and federal security authorities are investigating the breach. The Rhysida ransomware group has claimed responsibility and alleges it stole roughly **5.8 TB** of data, demanding **30 Bitcoin**—worth more than €2 million—and threatening to publish the material. The group claims the haul includes personal, personnel, financial, credential, legal, health, infrastructure, and potentially classified records affecting about 12,076 people, but Berlin has not verified the authenticity, sensitivity, or scope of the alleged data and says it will not pay. Officials said no election-related data has been identified as compromised ahead of the state-parliament election.
Sep 5, 2026
Berlin confirmed that attackers exfiltrated data from parts of its state administration between 7 and 12 August, prompting the disconnection of affected Senate administrations from the state network on 14 August. Reporting links the incident to the Rhysida ransomware ecosystem, whose suspected intrusion activity is associated with Vanilla Tempest tactics including malvertising, trojanized or fraudulently signed installers, Endico, Broomstick/Oyster and Supper malware, scheduled-task persistence, and Active Directory discovery; a claimed compromise of Stuttgart remains publicly unverified. The incident has intensified criticism of Germany's fragmented public-sector cyber defense. The federal Interior Ministry said it will abandon a proposed constitutional amendment that would have established the Federal Office for Information Security (**BSI**) as a central cybersecurity authority, instead relying on existing constitutional powers, 14 federal-state cooperation agreements, NIS2-derived BSI authorities, and increased staffing and funding. Critics argue that this approach will leave state and municipal systems insufficiently coordinated against sophisticated, potentially state-directed intrusions.
Sep 11, 2026
The British Library said personal data stolen in its 31 October cyberattack was leaked online and appeared to be offered for sale, with evidence indicating the material came from internal HR records. Images posted by the attackers appeared to show employment contracts and passport information, and the library warned that employee data had been exposed while major disruption continued across its website, online systems, reading rooms, and public Wi‑Fi. The institution urged users to change any reused passwords and said it was working with the UK National Cyber Security Centre, the Metropolitan Police, and external cybersecurity specialists. The ransomware group **Rhysida** claimed responsibility and advertised the stolen data on its leak site with a starting bid of **20 bitcoin**, in what researchers described as a **double-extortion** operation combining system encryption with data theft. US agencies including the FBI and CISA had recently warned that Rhysida has targeted organizations across education, manufacturing, IT, and government, while private-sector researchers linked the group to attacks in Europe, the Middle East, and the Americas and assessed it may be a rebrand of the older **Vice Society** operation. Analysts said Rhysida commonly gains access through phishing or compromised VPN accounts and uses ransom notes titled `CriticalBreachDetected`.
Jun 29, 2026