2026 Berlin state government — Rhysida extortion; Landesnetz data theft (Aug 7–12+); refuses ransom
Data compromised
Government confirms ongoing forensic review; Rhysida claims contracts, personnel files, passwords, contacts, and other senate data — scope unverified pending official census
Technical writeup
Verified government disclosure with actor extortion overlay — August 2026. Berlin’s senate said attackers accessed the city-state Landesnetz from at least August 7, with further leaks found in transport and urban-development departments; housing-benefit systems were disrupted when networks were isolated August 14. Mayor Kai Wegner and Interior Senator Iris Spranger confirmed an extortion demand (reported ~30 bitcoin) and refused payment. Rhysida claimed ~5.79TB stolen and threatened a dark-web auction; officials said election infrastructure was not affected and scope of personal data remains under forensic review with U.S. specialists engaged. recordsAffected 0 pending Berlin census; companyConfirmed true for incident and exfiltration; Rhysida file inventory unverified until official notice.
Root cause
Cyberattack on Berlin Landesnetz state network; data exfiltration from at least Aug 7; Rhysida demands 30 BTC and threatens auction of ~5.79TB