Berlin Cyberattack: Ransomware Group Auctions Stolen Data

On August 28, 2026, the Rhysida ransomware group announced it would auction 5.79 terabytes of data stolen from Berlin state agencies after city officials refused to pay a ransom demand of 30 bitcoin (approximately $77,622). The data includes 46,500 contracts, emails, phone numbers, passwords, and classified information. The cyberattack occurred earlier in August, prompting the shutdown of some city systems. Berlin's Mayor Kai Wegner stated that the city would not submit to extortion and confirmed that election infrastructure remains secure ahead of the upcoming elections on September 20. The Rhysida group, believed to operate from Russia or Eastern Europe, has claimed responsibility for numerous attacks since its emergence in June 2023. Investigations are ongoing to assess the full scope of the breach and the nature of the compromised data.

Key Points: • Rhysida ransomware group auctioning 5.79 TB of stolen Berlin data after ransom refusal. • Berlin officials confirmed no election-related data was compromised ahead of September elections. • The attack forced the shutdown of some city systems, impacting public services temporarily.