Bbc Rhysida Ransomware Group Targets Berlin Ahead of Elections
Article Content
- •Rhysida ransomware group stole 5.79 TB of data from Berlin's state agencies.
- •The group is auctioning the stolen data for 30 bitcoins after ransom refusal.
- •Berlin officials confirmed no election-related data was compromised ahead of the September elections.
The Rhysida ransomware group has claimed responsibility for a cyberattack on Berlin's state agencies, stealing 5.79 terabytes of data, including sensitive contracts and personal information. The group is auctioning the data for 30 bitcoins (approximately $77,622) after city officials refused to pay a ransom demand. The attack occurred between August 7 and August 14, 2026, leading to significant disruptions in city services, particularly in housing and environmental departments. Berlin's Mayor Kai Wegner stated that the city will not succumb to extortion and emphasized that election infrastructure remains secure ahead of the September 20 elections. Investigations are ongoing to assess the full scope of the data breach and its implications. Rhysida has been linked to numerous attacks since its emergence in June 2023, primarily targeting government institutions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (80)
Following this threat?
Track Rhysida and British Library in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Anne Arundel County Faces Second Cyberattack in 18 Months Anne Arundel County, Maryland, confirmed a data breach on August 28, 2026, where hackers accessed and copied files from a limited number of government systems. The Rhysida ransomware gang claimed responsibility, threatening to leak 2.6 terabytes of documents unless a $2 million ransom is paid. County officials stated… 
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…