Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Berlin's state government hit by data theft breach

Incident
First reported
Last updated
Happening score
H score 70
3 unique sources, 3 articles

Summary

Hide ▲

Berlin is dealing with a Rhysida ransomware extortion attempt after the gang listed the city on its data leak site. The city says the attack was discovered in mid-August, that it will not pay, and that the State Criminal Police Office, the public prosecutor's office, and federal security agencies are investigating. Rhysida’s post claimed 5.79 TB of data and about 1.44 million files from Berlin’s administrative network, while officials said there is no evidence election data was compromised and the Berlin House of Representatives election environment is secure. The leak-site claim also cited 148 IBANs, more than 3,200 nondisclosure agreements, and other records, but Berlin has not confirmed those figures.

Cases

Rhysida extortion over Berlin administrative network compromise (2)

Related Happenings

Berlin administrative network data leak after Rhysida claim

Data Leak
H score74 First: 31.08.2026 16:30 Last: 31.08.2026 16:30 Sources 1

How related: The threat actor claims to have exfiltrated 5.79 TB of data, comprising approximately 1.44 million files, from Berlin’s administrative network.

About this happening: Berlin faces a Rhysida-linked data leak threat after the group listed the city on its leak site and claimed a 5.79 TB exfiltration from Berlin’s administrative netwo...

Open Happening

DoJ charges Mabna Institute members and State Department offers reward

Law Enforcement
H score70 First: 20.08.2026 20:23 Last: 20.08.2026 20:23 Sources 1

About this happening: U.S. Department of Justice charged 17 Mabna Institute members in a cyber intrusion case tied to Iran's IRGC, and the U.S. Department of State announced a $10...

Open Happening

Union County, Ohio stolen records extortion leak

Data Leak
H score49 First: 04.07.2026 15:47 Last: 04.07.2026 15:47 Sources 1

About this happening: Union County, Ohio faced a stolen-records leak after attackers took county files and used them to extort about $1 million to stop publication. The exposure affected ...

Open Happening

First VPN had assets seized in First VPN takedown

Law Enforcement
H score17 First: 21.05.2026 18:30 Last: 21.05.2026 18:30 Sources 1

About this happening: Authorities took down First VPN, a ransomware-linked service used to hide cybercrime activity, in a coordinated action led by France and the Netherlands. The operation...

Open Happening

First VPN takedown by Europol and French-Dutch authorities

Law Enforcement
H score17 First: 21.05.2026 16:09 Last: 21.05.2026 16:09 Sources 1

About this happening: Europol and French and Dutch authorities took First VPN offline in a cross-border operation that also seized servers and arrested the administrator. The case m...

Open Happening

Timeline

  1. 29.08.2026 00:30 2 articles · 13d ago

    Senate department reports first data outflow

    Victim Impact Update

    The Senate Department for Mobility, Transport, Climate Protection and Environment first reported a data outflow from its portfolio, and forensic work later tied additional exfiltration to August 7-12, 2026.

    Show sources
    Open in new tab
  3. 29.08.2026 00:30 1 articles · 13d ago

    Berlin discloses compromise and extortion attempt

    Initial Disclosure

    Berlin first disclosed that forensic work had established a compromise of the state administrative network and said it was the target of an extortion attempt; both affected departments had been isolated since the previous Friday.

    Show sources
    Open in new tab
  5. 29.08.2026 00:30 3 articles · 13d ago

    Rhysida leak site posts Berlin, Germany entry

    Attribution Update

    A Rhysida darknet leak-site entry titled "Berlin, Germany" was added on August 28 and claimed 5.79 terabytes of data, around 1.44 million files, and personal information on 12,076 individuals; no ransom figure appeared in the entry.

    Show sources
    Open in new tab