Rhysida extortion over Berlin administrative network compromise

Attackers using **Rhysida** leak-site extortion are pressuring **Berlin's administrative network** after the city confirmed a compromise and the group posted a public leak claim on August 28. Available evidence places related data outflow in mid-August, with forensic work tying additional exfiltration to August 7-12 and officials isolating affected departments as the investigation widened. Rhysida's leak-site entry identified the victim as **Berlin, Germany** and claimed **5.79 TB** of data and about **1.44 million files**, turning the intrusion into a public publication threat. The claimed haul spans government, legal, financial, HR, infrastructure, health, mapping, email, database, and credential-related material, including **148 IBANs**, plaintext credentials, password-vault content, SQL dumps, and personnel records. The attackers also asserted that personal information on **12,076 individuals** was involved, but Berlin has not publicly confirmed the full scope of the stolen data or every department named in the leak-site material. Officials have said there is no evidence election data was compromised and that the technical environment for the upcoming Berlin House of Representatives election remains secure. Berlin says it will **not pay** the attacker, and the State Criminal Police Office, the public prosecutor's office, and federal security agencies are investigating. One affected department was cut off from the network on August 14, all Senate departments were reconnected on August 23, and forensic scanning of the state network has continued. The immediate picture is a confirmed network compromise, an active extortion demand backed by a public leak claim, and unresolved uncertainty over what data was actually taken and what may still be published.