Overview
- The intrusion was first detected by the Berlin administration on 14 August and forced parts of the Landesnetz to be isolated, disrupting services such as Wohngeld processing.
- Media outlets report a Darknet post attributed to the Rhysida ransomware group claiming about 5.7–6 terabytes of exfiltrated files and demanding 30 bitcoin, a sum worth roughly €2 million.
- Mayor Kai Wegner and the Senat publicly confirmed an extortion attempt and said the city will not pay, while prosecutors, the Landeskriminalamt and federal agencies continue formal investigations.
- External cybersecurity teams, reportedly including CrowdStrike, are conducting forensic work to verify which files — possibly contracts, case files, passwords and emergency plans — were taken.
- Partial system restorations were completed this month but authorities are still assessing damage, the authenticity of leaked material remains unverified, and the case raises political and service continuity risks ahead of the 20 September vote.