“Gross Negligence” – Outrage Following Massive Data Breach in Berlin

5.8 terabytes on the dark web

The extortionists demanded a ransom of 30 Bitcoin, equivalent to about two million Swiss francs. (File photo)

German Press Agency

Since Friday, 5.8 terabytes of data from the Berlin municipal government have been published on the dark web. The true extent of the data breach has been difficult to gauge so far—but one expert is horrified.

R. blue News, DPA, DPA

05.09.2026, 22:31•05.09.2026, 22:48Here’s what it’s all aboutFollowing a cyberattack on the Berlin state government, hackers posted approximately 1.44 million files containing 5.8 terabytes of data on the dark web.In addition to personal documents, this is said to include sensitive information about water treatment plants, the electricity grid, prisons, and defense contractors.IT experts and the opposition are accusing the Berlin Senate of serious failures in cybersecurity and are calling for a thorough investigation.Summary created with

Following a hacker attack on the Berlin state government, the extent of the data breach and the consequences of large amounts of data being published on the dark web are gradually coming to light. About two weeks before the House of Representatives election, the opposition is accusing the CDU-SPD Senate of poor crisis management. IT expert Manuel Atug is also making serious allegations.

“The State of Berlin acted with gross negligence and intentionally failed to comply with security regulations,” Atug told the German Press Agency. “I am truly shocked and speechless.” He explained that there are very strict and precise regulations, as well as several security levels, governing the storage and processing of classified documents. Apparently, these were not adequately enforced.

Atug is the founder and spokesperson for AG Kritis, an independent working group that focuses on critical infrastructure. He works as a security consultant for critical infrastructure.

This content comes from external providers such as YouTube, TikTok, or Facebook. Please enable “Swisscom advertising on third-party platforms” to view this content.

Cookie Settings

Critical infrastructure refers to all those sectors whose disruption or failure could lead to supply shortages, threats to public safety, and other dramatic consequences.

“Your cybersecurity isn’t up to par”

Atug said he had been summoned twice as an expert witness to the Berlin Interior Committee, in 2023 and 2025. At the time, he had pointed out glaring security gaps to the officials in charge: “Your cybersecurity is in shambles. You urgently need to address your security processes.” He warned that neglecting security would have serious consequences. “That is exactly what has happened now,” said the expert.

Following a cyberattack on the Berlin municipal administration, approximately 1.44 million files totaling 5.8 terabytes were published on the dark web on Friday. The criminal hacker group Rhysida had secretly stolen the data in mid-August and demanded a ransom of 30 bitcoins—equivalent to about two million Swiss francs. The Senate did not pay the ransom.

This content comes from external providers such as YouTube, TikTok, or Facebook. Please enable “Swisscom advertising on third-party platforms” to view this content.

Cookie Settings

Berlin’s Governing Mayor Kai Wegner (CDU) told the “Bild” that they are currently investigating to determine what information was leaked. The goal now is to quickly identify and notify those who may be affected. “We are trying to reach those affected as quickly as possible.”

Data on power plants and defense contractors published?

The “Tagesspiegel” reports that, in addition to a large amount of personal data, the hackers also published information relevant to the security of the Federal Republic of Germany and the capital. According to the report, this includes data on facilities requiring special protection, such as combined heat and power plants, fuel depots, emergency power systems, and substations. The hackers are also said to have leaked classified data on prisons, water treatment plants, defense contractors, the German Armed Forces, and the Berlin Interior Administration that pertain to national defense.

IT expert Atug does not want to view the documents on the dark web himself for ethical reasons. However, he explained that he had learned from reliable sources that the newspaper’s claims were accurate, at least in the case of the information regarding civil defense and defense contractors.

Federal Government Steps In

So how much sensitive data was leaked? A government spokesperson said the federal government is closely monitoring the information and investigations into the data leak. The agencies involved are continuously coordinating their information. “Following an analysis of potential security risks, appropriate measures to safeguard military security will be implemented. Based on current information, federal data systems are not affected,” the spokesperson said.

The “Spiegel” reports, citing a random sample it conducted itself, that numerous federal matters were affected by the cyberattack. For example, the data reportedly contains more than 550 files related to the expansion of the Chancellery, including expert reports, plans, and statements—such as those from the State Criminal Police Office.

Jochim Selzer, spokesperson for the Chaos Computer Club, says he has looked at some of the leaked data. In doing so, he found sensitive information about the state of Berlin’s water supply. Sifting through the massive amounts of data is very time-consuming. You can’t just use CTRL+F to search for specific terms, Selzer explained.

Passports, employment contracts, job application materials

The relevant page on the dark web is organized into three subpages. Each subpage has a file tree that you can click through, said Selzer, who is a data protection expert. He looked primarily for personal data. Among other things, he found scanned passports without redacted information, employment contracts, job application documents, and sick leave notices. 

How can such hacker attacks be prevented in the future? Expert Atug said: “Berlin must allocate funds and resources in its budget for cybersecurity and national security, integrate these into long-term security processes, and make them a priority.” The focus should be less on surveillance and more on serious and sustainable IT security, especially when it comes to national security.

“A Major Government Failure”

The opposition parties in the Berlin House of Representatives leveled sharp accusations against the state government. The Left Party’s top candidate, Elif Eralp, spoke of a “glaring failure of the CDU government.” She called on the Senate to declare a major disaster. AfD top candidate Kristin Brinker called for a swift and comprehensive investigation. Green Party lead candidate Werner Graf criticized the fact that there is still no plan for how to deal with the danger, protect and warn those affected, and better organize safety measures. “The week passed without any discernible precautions. That is a scandal.”

SPD mayoral candidate Steffen Krach called for a massive expansion of IT security and cyber defense. FDP lead candidate Christoph Meyer called on Wegner and Spranger to resign. “In this Senate, everyone seems to be clinging to their positions, while serious mistakes go unpunished.”