Berlin Confirms Extortion Attempt After Administrative Network Attack, Investigating Data Leak Scope
Following a cyber incident in the state administrative network, Berlin confirmed an extortion attempt. The city will not meet the demands, while the investigation has uncovered another data leak.
Berlin confirmed an extortion attempt following a cyberattack on the city’s administrative network. On August 28, the state Senate said it would not meet the extortionists’ demands. The incident is being investigated by the state criminal police, prosecutors and federal security agencies.
Forensic analysis also uncovered another data leak involving the Senatsverwaltung für Mobilität, Verkehr, Klimaschutz und Umwelt, the authority for mobility, transport, climate protection and the environment. Authorities cannot yet determine the scope or content of the leaked data. They do not rule out that personal or other nonpublic information may be among it.
Berlin Confirms Extortion Attempt and Refuses to Pay
The Senate announced that it would not meet the ransom demand. However, it has not publicly confirmed the amount demanded, the attackers’ identity or the specific volume of stolen data.
Authorities affected by the incident disconnected from the state network as early as August 14. The forensic investigation, network scanning and work by the ICT crisis team are continuing.
Another Data Leak Is Still Being Investigated
Berlin officially confirmed another data leak from the aforementioned Senate authority, but did not state which records were affected or how many people the incident may concern. The scope and content of the data are not yet known.
Personal or other nonpublic information could therefore potentially be at risk, but the precise impact remains under investigation.
The Attackers and Method of Intrusion Are Unconfirmed
Media outlets and services monitoring data leaks have linked the incident to the Rhysida group. Berlin has not officially confirmed this attribution, however. The attackers’ claims about the amount of stolen data or the number of potentially affected people have likewise not been independently verified.
The method of the initial intrusion into the network is also not publicly known. Authorities have not confirmed a specific exploited vulnerability, compromised account or other entry point.
What Happens Next
The results of the forensic investigation will be crucial: the scope and nature of the leaked data, any notifications to affected individuals and findings about the intrusion vector. Confirmation or refutation of the reported link to the Rhysida group will also be important.
Berlin’s case is a confirmed incident in public administration involving a data leak and a subsequent extortion attempt. The precise impact on systems, services and people whose data may have been affected remains under investigation.
Sources
- Berlin.de – Wegner und Spranger: „Berlin lässt sich nicht erpressen“ – Confirms the extortion attempt, refusal to pay, ongoing investigation, additional data leak and continuing crisis team response.
- Berlin.de – Mehr Daten beim IKT-Vorfall abgeflossen – States that additional data leaks were identified, while their scope and content are still being investigated and personal data cannot be ruled out.
- tagesschau.de – Hacker fordern Lösegeld nach Angriff auf Berliner Landesnetz – Independently corroborates the confirmation of the ransom demand and Berlin’s public refusal to meet it.
Verified and updated: 08/30/2026 13:28
