Berlin's state government is bracing for fallout that may reach far beyond the capital after the Rhysida ransomware gang followed through on its threat and published around 1.44 million files — roughly 5.8 terabytes — of data stolen from the city's administration on the dark web. German politicians and security experts describe the dump as a potential "data super-GAU" (the German shorthand for a catastrophic failure), with material that appears to reach into national defense and critical infrastructure.

The data went online on Friday, 4 September, shortly after a ransom deadline set by the group expired. Berlin had refused to pay: the state confirmed in late August that the attackers were demanding 30 bitcoin (around two million euros), and Governing Mayor Kai Wegner insisted that "the State of Berlin will not give in to blackmail."

Attackers were inside the state network between 7 and 12 August, quietly siphoning data from two Senate departments — those responsible for urban development, building and housing, and for mobility, transport, environmental and climate protection. The intrusion was detected on 14 August and the affected authorities were cut off from the state network. The disruption was tangible: by 21 August, some 50,000 households were still waiting for housing-benefit payments because systems were offline. Services were largely restored by 24 August, but the full picture of what was taken only emerged once Rhysida published the data after its auction-style countdown expired.

The sheer volume makes assessment difficult. Chaos Computer Club spokesman Joachim Selzer noted the dump is so large that simple text searches are impractical. According to media reports and experts, the files go well beyond the personal records of civil servants — scanned passports, employment contracts, sick notes and application documents — and appear to include plaintext passwords, more than 46,500 state contracts, and documentation touching critical infrastructure such as Berlin's water supply, heating plants, fuel depots, emergency power systems, substations, prisons and waterworks. Euronews reported the leak contains a folder on CBRN threat planning (chemical, biological, radiological and nuclear risks). Investigative journalist Lars Winkelsdorf said documents also concern national defense, from the federal government's crisis communication channels to defense-related companies and emergency plans — claims the authorities have not confirmed.

The Bundeswehr announced it would take measures to protect military security after analyzing the risks. Germany's BSI federal cyber agency warned of an "elevated threat level" for society, saying data on critical infrastructure and organizations could be misused by foreign intelligence services or terrorists, while affected individuals face identity theft and targeted phishing.

Politicians reacted with alarm. Konstantin von Notz, deputy parliamentary leader of the Greens, called it possibly the most serious IT security case ever seen at state level, predicting it would cost taxpayers millions. CDU foreign-policy expert Roderich Kiesewetter told the Süddeutsche Zeitung the data loss was "of grave magnitude and endangers our national security." IT expert Manuel Atug accused Berlin of gross negligence, saying classified-information protection rules had not been followed and that he had warned of security gaps when testifying before Berlin's interior committee in 2023 and 2025.

Berlin has now set up a central coordination unit to sift and assess the leaked data. On a risk-based approach, affected citizens, employees and companies are to be contacted by letter or email, the Senate Chancellery said. Federal authorities — the BSI, the BKA federal police and the domestic intelligence service — are involved, with findings pooled in the joint cyber-defense center. Berlin described the attack as "an extremely serious crime" and an attack on the state itself, and urged the public not to spread unverified claims on social media.

The episode lands less than two weeks before Berlin elects a new state parliament on 20 September. State election officer Stephan Bröchler said the election environment is not affected. Investigators said there is currently no indication that the state network remains compromised; forensic reviews and investigations are ongoing.

Sources