Overview
- Hackers tied to the Rhysida group copied and then published roughly 1.2 to 1.44 million files—about 5.8 terabytes—after Berlin refused a reported 30‑Bitcoin ransom.
- The intrusion took place between August 7 and 12, the city detected unusual activity on August 14, and the incident was publicly disclosed three days later.
- Berlin’s Digital State Secretary said the files are limited to the lowest secrecy tier and not national‑security‑level material, but independent researchers report documents that could relate to water, power, prisons and defence contractors and reviews are continuing.
- The Bundesamt für Sicherheit in der Informationstechnik, the BKA and the BfV are conducting joint forensic work in the Gemeinsames Cyberabwehrzentrum and will notify affected citizens, employees and companies as risk assessments are completed.
- Authorities warn stolen personal data can fuel identity theft and targeted phishing, so people should change reused passwords, enable two‑factor authentication and monitor accounts; politicians are demanding accountability and the city faces likely costly IT fixes.