2026 Berlin state government — Rhysida extortion; Landesnetz data theft (Aug 7–12+); refuses ransom

Verified government disclosure with actor extortion overlay — August 2026. Berlin’s senate said attackers accessed the city-state Landesnetz from at least August 7, with further leaks found in transport and urban-development departments; housing-benefit systems were disrupted when networks were isolated August 14. Mayor Kai Wegner and Interior Senator Iris Spranger confirmed an extortion demand (reported ~30 bitcoin) and refused payment. Rhysida claimed ~5.79TB stolen and threatened a dark-web auction; officials said election infrastructure was not affected and scope of personal data remains under forensic review with U.S. specialists engaged. recordsAffected 0 pending Berlin census; companyConfirmed true for incident and exfiltration; Rhysida file inventory unverified until official notice. Update September 7, 2026 (The Record / Berlin.gov): attackers published additional stolen login credentials and other material over the weekend; Berlin data-protection authority said large volumes from urban-development and transport ministries include employee and possibly resident PII (names, addresses, DOB, bank info, emails, phones, correspondence, submitted documents). Task force reviewing who is affected; Rhysida previously claimed ~5.79TB.