Berlin cyberattack exposes government and citizen data
Written by Rebecca Uffindell Tue 8 Sep 2026
A cyberattack against Berlin’s administration resulted in a “considerable amount of data” being copied and subsequently published, with authorities confirming that personal information belonging to public-sector employees and potentially Berlin residents is among the material affected.
The incidents occurred between 7 and 12 August and affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment.
Berlin authorities said the volume of published material meant it had not yet been possible to review the entire dataset.
Information known to be potentially affected includes names, addresses and dates of birth, alongside the contents and data associated with correspondence with the two Senate administrations. Depending on an individual’s dealings with the departments, the material could also include bank details, email addresses, telephone numbers, and submitted copies of documents.
Berlin Disconnects Affected Systems
The affected systems were disconnected from Berlin’s wider government network on 14 August, according to reporting by The Record.
Both Senate departments continued operating, although the disruption left some employees without their usual access to email and the internet.
Berlin has brought together the State Criminal Police Office, the two affected Senate administrations, the State Data Protection Authority, the State Plenipotentiary for Information Security and other security authorities as part of its response.
Kai Wegner, Governing Mayor of Berlin, described the incident as a serious crime against the state.
“The LKA and the Senate administrations concerned are now working hard to evaluate the stolen data,” said Wegner. “We will inform, advise and support the affected employees and Berliners as quickly as possible.”
Wegner said Berlin was also in close contact with federal security authorities.
Rhysida Claims 5.79TB of Stolen Data
The Rhysida ransomware group claimed responsibility for the attack in August, according to The Record, alleging that it had stolen 5.79TB of data containing tens of thousands of contracts, emails, passwords and other classified information.
Those claims have not been verified by Berlin authorities.
Berlin confirmed that it received an extortion demand but has not publicly attributed the attack to Rhysida or verified the group’s account of what was stolen.
Subsequent reporting by Berlin.de said the minimum bid attached to the stolen data was 30 bitcoin, equivalent at the time to around €2 million (£1.7 billion).
Berlin has said it will not pay.
“The State of Berlin will not give in to blackmail. The safety of the State of Berlin’s staff and the people of Berlin is our top priority,” said Florian Hauer, Chief Digital Officer for the State of Berlin.
Hauer added that authorities were working to further secure the state network.
Authorities Warn of Secondary Fraud Risks
The publication of stolen information creates risks beyond the original intrusion, particularly where personal and financial information may have been exposed.
Berlin has advised potentially affected people to change passwords, particularly for administrative and online services, and to check account and credit-card transactions.
Authorities have also warned people to be alert to phishing attempts, avoid links in unusual messages and not open communications from unknown or suspicious senders.
People should not make payments to anyone attempting to blackmail them and should instead contact police, Berlin said.
Suspicious incidents should be documented. Where bank access, payment cards, mobile numbers or electronic IDs have been misused, authorities advise using Germany’s 116 116 blocking service and filing a police complaint.
The guidance reflects how a breach of government information can create subsequent opportunities for attackers. Names, contact information, correspondence, and other contextual data can potentially make fraudulent approaches appear more credible.
BSI Separately Warns of Multi-stage Attacks
Separately, Germany’s Federal Office for Information Security (BSI) issued a warning after being informed on 26 August of a compromise affecting the network of a state institution.
The BSI said subsequent analysis showed a sequence consistent with the multi-stage TerminalFix attacks recently described by Microsoft.
It added that reports received by the agency indicated attempts had been made during such attacks to install ransomware and extract information as part of double-extortion activity, where victims can also be threatened with publication of stolen data.
The BSI statement should not be read as attribution of the Berlin Senate attack to TerminalFix based on the information currently available. It concerns a separately described compromise of a state institution.
Berlin authorities have also stressed that there is no evidence that election systems were affected or that election-related data was stolen, and said the election environment remained secure.
Scale of Published Data Leaves Investigation Ongoing
The immediate challenge for Berlin is establishing precisely what information has been exposed.
Authorities have already confirmed that employee personal data and potentially information relating to citizens was published, but the volume of material means the contents have not yet been fully evaluated.
That leaves an important distinction between what Berlin has established and what the alleged attackers claim to possess.
The confirmed breach is substantial enough to trigger coordination between Berlin’s police, data-protection, information-security, and government authorities and warnings to individuals who may be affected. Claims about the 5.79TB dataset and its precise contents remain attributable to Rhysida rather than established findings from the investigation.
For Berlin, the incident has consequently moved beyond restoring affected government systems. Authorities now face the longer task of identifying what was published, notifying and supporting those affected, and limiting the opportunities for further fraud created by information already exposed.
Written by Rebecca Uffindell Tue 8 Sep 2026
Tags:
Berlin data breach Germany phishing ransomwareMost Viewed News
Fri 2 Oct 2026
AI skills gap grows despite 64% of workers using AI