Overview
- The hacker group Rhysida posted the stolen Berlin dataset on Friday, September 4, making about 5.2–5.8 terabytes and roughly 1.44 million files available on Darknet download sites.
- The published material reportedly includes personal records, payroll and personnel files, passwords in clear text, contracts, emergency plans and documents linked to critical infrastructure.
- The Berlin Senate declined to pay the 30 Bitcoin ransom demand and set up a special investigative unit while the Senatsverwaltungen work with the Landeskriminalamt, the BSI and federal partners.
- Authorities and hired IT forensics teams are prioritizing file review to identify individuals at risk, notify affected people under GDPR rules, and advise on immediate actions such as password resets and two‑factor authentication.
- Security experts warn the leak could fuel identity theft, targeted phishing and exploitation of infrastructure weaknesses and note Rhysida’s prior international attacks, though any state links remain unproven and under investigation.