Hackers leak nearly 6TB of sensitive Berlin government data

The ransomware group Rhysida has published nearly six terabytes of data stolen from Berlin's state administration on the dark web, spanning close to 1.44 million files, after city officials refused to pay a ransom.

The group first claimed the breach on its leak site on August 28, giving Berlin roughly a week before making good on its threat.

The hacker group wanted a ransom of 30 bitcoins, which was approximately worth 2 million euros. The timer for this expired on Friday. 

It was already known earlier by the Berlin Senate that it would not engage in any form of negotiation, and even the governing mayor of the city has openly said that the city will not be blackmailed.

Later it emerged that the theft of the data actually took place from the 7th to the 12th of August.

One of the data which was leaked included a folder named "AG CBRN-Rahmenplanung" related to planning regarding threats posed by chemical, biological, radiological, and nuclear attacks.

Investigative journalist Lars Winkelsdorf reported about the leak in X, stating that the files which were leaked included police investigation reports, defence plans of the nation, government communications that were supposed to be used in the event of a major crisis, and even emergency plans related to defence-orientated firms.

Beyond the classified material, the dump reportedly includes personal records tied to Berlin's own civil servants: birth certificates, absence lists, phone numbers, and home addresses.

Earlier reporting on the leak-site listing put the number of named individuals affected above 12,000, alongside thousands of email addresses, phone numbers, and financial records, though Berlin has not independently confirmed those attacker-supplied figures.

Berlin has acknowledged a major cyber incident and confirmed that personal and non-public data cannot be ruled out from what was taken, but the city has not verified Rhysida's specific file counts or data categories, which remain the group's own claims pending forensic review.

Officials have confirmed that systems supporting Berlin's September 20 state election are isolated from the compromised network and were not affected.

State police, prosecutors, and federal security services are continuing to investigate, and with files now circulating publicly, the more immediate concern shifts from ransom leverage to who else might already be downloading them.