Rhysida Claims 5.79TB From Berlin Government — City Refuses 30 Bitcoin Ransom as September 20 Elections Approach

Summary

The Rhysida ransomware group posted a listing titled simply Berlin, Germany on its dark web leak site on August 28, 2026, claiming to have exfiltrated 5.79 terabytes of data comprising approximately 1.44 million files from Berlin's state administrative network. Governing Mayor Kai Wegner and Interior Senator Iris Spranger confirmed in an emergency Senate session at the Rotes Rathaus that the city had been subjected to a cyberattack and data theft and was receiving an extortion demand. The city confirmed data theft and an extortion attempt but did not attribute the attack to Rhysida or verify the group's specific claims about data volume or content. Mayor Wegner stated publicly that Berlin will not pay. Rhysida's claimed dataset includes 46,500 contracts, approximately 80,000 administrative fine proceedings, personnel files, payroll information, SQL database dumps, identity documents, email archives, banking information, and approximately 6,000 files reportedly containing plaintext credentials, database account details, payment system data, and password vaults. German media citing Der Spiegel also reported Bundesrat committee records and materials related to the handling of classified documents among the claimed contents. Rhysida set a seven-day auction countdown at a starting price of 30 bitcoin, approximately $2.37 million at August 28 prices. The group is also using threatened GDPR violations as additional leverage against the city. The attack and extortion demand arrive eleven days before Berlin's House of Representatives state elections on September 20. Interior Senator Spranger confirmed election infrastructure was not affected and described it as secure.

Timeline

Domain Intelligence

Context

berlin.de scores 56.68 — a low-trust range score for the official domain of Germany's capital city, one of Europe's largest municipal governments, reflecting the current state of the domain's trust profile in WarmBadge's live intelligence. The score is not static. The Rhysida extortion campaign against Berlin follows the group's documented pattern of targeting government and public sector institutions. Previous high-profile Rhysida victims include the British Library and several US healthcare systems. The timing against Berlin — eleven days before a state election — creates a specific political pressure dynamic alongside the financial extortion. Berlin's refusal to pay is consistent with law enforcement guidance across major Western jurisdictions, which uniformly advise against ransom payment on the grounds that payment funds further attacks and does not guarantee data recovery or deletion. Berlin's refusal makes the seven-day auction countdown operationally significant: if the countdown expires without negotiation, 1.44 million files including credential vaults and classified government material may become available to buyers on Rhysida's dark web marketplace.