In August 2026, one Major cyberattack on Berlin’s state government network resulted in the theft and subsequent publication of vast amounts of sensitive data. This incident is considered one of the most severe data breaches in Germany’s history.
📅 Timeline of the 2026 Berlin Cyberattack
- Early August 2026: The cybercriminal group Rhysida breached two departments of the Berlin Senate—Urban Development and Mobility/Transportation—and exfiltrated data. The intrusion went undetected for days.
- August 14: The two affected departments were isolated from the state network.
- August 28: The extortion came to light. Hackers demanded a ransom of 30 Bitcoin (approximately €2 million). Berlin’s Governing Mayor Kai Wegner publicly refused to negotiate with the attackers.
- September 4-5: After the deadline expired, the hackers published approximately 1.44 million files (around 5.8 terabytes) on the dark web
🔓 Attack Method and Perpetrator
- Entry Point: The breach began with a phishing attack. An employee of the transport authority fell victim to a malicious link. This specific technique, sometimes called “ClickFix” or “TerminalFix,” tricked the user into running a malicious command
Perpetrator: The ransomware group Rhysida, believed to be from Eastern Europe, claimed responsibility. The group has been active since 2023 and is known for targeting public institutions worldwide
📄 Scope of Data Leaked
The leaked data is extensive and highly sensitive, prompting experts to label it a “data super-GAU”
. It includes:
- Personal Data: Scanned ID documents, payroll records, birth certificates, and private addresses of government employees
.
Security-Relevant Information: Details on critical infrastructure such as power plants, water treatment facilities, prisons, and emergency power systems. Information on CBRN (Chemical, Biological, Radiological, Nuclear) threat scenarios was also exposed
Internal Government Documents: Data related to the expansion of the Federal Chancellery, financial records, contracts, and thousands of passwords
Citizen Data: The Berlin Senate has acknowledged that it cannot rule out the possibility that data belonging to individual citizens was also leaked
⚠️ Consequences and Aftermath
The attack caused significant disruptions, including a temporary halt in housing benefit payments to 50,000 households . Authorities have warned that the leaked data could facilitate identity theft and future phishing attempts. The incident has sparked intense political debate regarding the state of Berlin’s cybersecurity infrastructure, with experts and opposition politicians accusing the government of “gross negligence”
.
Note: There have been other cyberattacks targeting Berlin in the past, such as the 2015 Bundestag hack attributed to Russian group APT28, and a 2019 Emotet malware attack on the Kammergericht (higher regional court) . The 2026 incident is the most recent and largest in scale.
DW
Heise
Bluewin
DW
De-rt
https://www.n-tv.de/panorama/Hacker-veroeffentlichen-weitere-Berliner-Behoerdendaten-im-Darknet-id31275680.html#1
https://pl.euronews.com/next/2026/09/05/atak-hakerow-na-berlin-wysoce-wrazliwe-dane-kraza-po-darknetcie
https://www.bluewin.ch/en/news/international/gross-negligence-outrage-following-massive-data-breach-in-berlin-li.3589385#1
https://www.n-tv.de/panorama/Hacker-veroeffentlichen-weitere-Berliner-Behoerdendaten-im-Darknet-id31275680.html#1
https://www.bild.de/politik/inland/hacker-angriff-in-berlin-auch-buerger-betroffen-senat-schliesst-das-nicht-aus-6a9ff9f154ff84194d4caf3d#1