The German capital chose a hard line against digital blackmail: by refusing to hand over 30 BTC to the Rhysida group, Berlin saw more than 1.44 million stolen files freely shared on the dark web in early September 2026.
🔑 Key takeaways
- Rhysida claimed to have stolen 5.79 TB of data (~1.44M files) from Berlin’s administration on August 14, 2026.
- The hackers demanded a ransom of 30 bitcoins, worth roughly €2M at the time.
- Mayor Kai Wegner refused any payment, arguing there was no guarantee the data would actually be deleted.
- Without receiving the ransom, Rhysida published the data on the dark web on September 4, 2026.
- Berlin’s municipal elections on September 20, 2026 remain on track, with electoral infrastructure deemed secure.
A major cyberattack against the Berlin Land
On August 14, 2026, the Berlin Land administration was hit by a major cyberattack claimed a few days later by the Rhysida group. The intrusion affected several key services: housing, environment, mobility and transport. The impacted systems were disconnected from the administrative network for a week, blocking in particular the processing and payment of housing benefits. Services have since been reconnected while forensic investigations continue to determine the exact scope of the compromise.
In a post published on August 28 on its leak site, Rhysida claims to have exfiltrated 5.79 terabytes of data, representing nearly 1.44 million files. The group says it stole names, email addresses, 148 IBAN numbers, credentials, passwords, HR files, payslips, identity documents, contracts, disciplinary records and documents related to critical infrastructure. These figures have not been officially confirmed by Berlin authorities, who did acknowledge that data exfiltration took place before the systems were taken offline.
30 BTC ransom and a categorical refusal
Rhysida set a seven-day ultimatum, expiring on Friday September 4, 2026. That evening, conservative mayor Kai Wegner publicly confirmed the extortion attempt. The next day, he admitted to the press that sensitive data had been stolen and said he wanted to inform the affected individuals as soon as possible.
| Item | Detail |
|---|---|
| Attack date | August 14, 2026 |
| Threat actor | Rhysida |
| Ransom demanded | 30 BTC (~€2M) |
| Data claimed | 5.79 TB / 1.44M files |
| Publication date | September 4, 2026 |
| Berlin’s stance | Total refusal to pay |
The refusal to pay was confirmed by both Kai Wegner and Iris Spranger, Senator for the Interior. The mayor, relayed by Bild, justified the position by pointing to the impossibility of guaranteeing the effective deletion of data after a payment, calling the situation a « serious offense ».
« Who can say that, even if we had paid, this data would not already be elsewhere for a long time? Berlin will not give in to blackmail. »
Kai Wegner, Mayor of Berlin
This stance is shared by several cybersecurity experts. Bianca Kastl, an expert at the Chaos Computer Club, told German public radio RBB Inforadio:
« If we keep supporting these groups financially or otherwise, they will keep acting. »
Bianca Kastl, Chaos Computer Club
Published data and a major identity theft risk
On September 4, 2026, Rhysida followed through on its threat: more than one million files were made available for download on the dark web, in several batches. Tagesschau, from German public television, confirmed the publication on September 5. According to RBB, the hackers accompanied the release with a laconic message: « Have fun, data hunters. »
Among the leaked files are payslips, contracts, scanned identity documents and, possibly, sensitive information related to construction projects. The presence of signatures, IBAN numbers and identity documents exposes the affected individuals to an increased risk of identity theft and banking fraud. Berlin authorities have indicated that the relevant senate administrations will inform individuals identified as at risk, in accordance with legal provisions.
A tried-and-tested playbook
Rhysida is no stranger to this kind of operation. In autumn 2023, the group targeted the British Library in London, demanding 20 bitcoins (worth more than €760,000 at the time). The British library refused to pay, and Rhysida then published approximately 500,000 files containing the personal data of visitors, subscribers and staff.
Germany’s BSI (Federal Office for Information Security) has indicated that the Berlin hack appears to be « exclusively financially motivated » rather than politically driven. The investigation is being conducted jointly by the Berlin Land criminal police, the Berlin public prosecutor’s office and federal security authorities, with the support of the federal government, which is closely monitoring the situation.
Conclusion: a resilience test one month before elections
This cyberattack comes one month before Berlin’s municipal elections on September 20, 2026. Berlin authorities have assured that no element indicating a compromise of electoral data has been discovered, and consider the technical infrastructure used for the vote as secure. The election is going ahead despite the leak of sensitive documents that touches hundreds of thousands of citizens.
The case illustrates the growing trend of ransomware operators demanding payment in bitcoin, a digital currency that is hard to trace but trackable on the blockchain (a public, immutable ledger of transactions). Berlin’s choice — refusing to pay and accepting the public leak of the data — could set a precedent in the fight against digital extortion and reinforce the « no pay » doctrine advocated by several cybersecurity agencies. The real impact on Berlin citizens, now exposed to a high risk of fraud and identity theft, remains to be measured in the coming weeks.
Sources
This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
