![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
September 07, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/dk\/wp-content\/uploads\/2026\/09\/image-89.png\")
<\/p>\n
Berlin refused a 30 Bitcoin ransom, leading hackers to leak 6TB of sensitive state administration and national defense data on the dark web.<\/p>\n
When a ransomware gang dumps nearly six terabytes of state administration files onto the dark web, ignoring them does not make the problem go away. The Rhysida ransomware<\/a> group recently carried out this exact threat against Berlin<\/a> after local authorities refused to pay a thirty Bitcoin ransom.<\/p>\n At the end of August, Berlin\u2019s state government confirmed it was dealing with an extortion attempt following an August cyberattack on the city-state\u2019s administrative network, and officials have already refused the requested ransom. The ransomware group\u00a0Rhysida<\/a>\u00a0claimed responsibility on its leak site August 28, posting an entry titled simply \u201cBerlin, Germany\u201d and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.<\/p>\n Rhysida claimed it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:<\/p>\n Personal data:\u00a012,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.<\/p>\n Sensitive records:\u00a0more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.<\/p>\n Credentials:\u00a0plaintext passwords and credentials for systems including Geb\u00e4udAtlas, the ePayment PAYONE database and Z_ADMIN accounts.<\/p>\n Government and legal material:\u00a0disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.<\/p>\n Classified information:\u00a0data related to classified-material handling and documents allegedly containing state secrets.<\/p>\n Critical infrastructure:\u00a0vulnerability analyses concerning Berlin\u2019s water supply.<\/p>\n Identity documents:\u00a0passports and ID cards from personnel records.<\/p>\n Other material:\u00a0contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL\/PST archives.<\/p>\n The group also claimed that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS\/BSIG requirements. These are Rhysida\u2019s claims and have not been independently verified.<\/p>\n The scale of the breach is staggering. Investigators are now looking at roughly 1.4 million files containing personal details of civil servants, internal infrastructure records, and critical government data.<\/p>\n The fallout goes far beyond routine data theft. Investigative journalist Lars Winkelsdorf pointed out the gravity of the situation on social media. <\/p>\n Die absolute Vollkatastrophe ist eingetreten<\/p>\n Dieses Datenleck ist schlimmer als alle bisherigen Terroranschl\u00e4ge zusammen 1\/xhttps:\/\/t.co\/epU4mCYgew<\/a><\/p>\n \u2014 Lars Winkelsdorf (@winkelsdorf) September 4, 2026<\/a><\/p>\n \u201cIn addition to LKA documents related to investigations, the files also include plans concerning national defense\u2014ranging from the federal government\u2019s secret communication channels in the event of an apocalypse to defense-related companies and emergency plans developed by government agencies,\u201d Winkelsdorf wrote. <\/p>\n Exposing crisis response plans and secret communication channels turns a financial shakedown into a national security headache.<\/p>\n Worse still, the leaked material includes files concerning chemical, biological, radiological, and nuclear threats. <\/p>\n \u201cAmong the published files is a folder titled \u201cAG CBRN-Rahmenplanung.\u201d CBRN stands for chemical, biological, radiological and nuclear threats,\u201d notes the Euronews report<\/a><\/p>\n Having that kind of operational data floating around public forums gives hostile actors a blueprint for disaster.<\/p>\n Refusing to pay ransoms is the right policy, but it rarely stops the bleeding once the network is compromised. Governments keep treating cybersecurity like an IT expense rather than an existential line of defense. <\/p>\n Until boards start treating network segmentation with the same seriousness as physical security, we will keep watching expensive countdown timers tick down to zero.<\/p>\n Berlin\u2019s state government announced<\/a> the launch of a crisis response after the threat actors published the stolen data.<\/p>\n \u201cA \u200ccentral \u2060crisis unit will oversee the review, verification and assessment of the leaked data and support efforts to inform affected citizens and \u200bbusinesses, said the \u200bcity.\u201d Reuters reports<\/a>.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n Pierluigi\u00a0Paganini<\/a><\/p>\n (SecurityAffairs<\/a>\u00a0\u2013\u00a0hacking,\u00a0Berlin)<\/p>\n \t\t\t\t\t\t\t\t\t\t\t![\"\"](\"https:\/\/www.europesays.com\/dk\/wp-content\/uploads\/2026\/09\/1788771860_48_image-89.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.europesays.com\/dk\/wp-content\/uploads\/2026\/09\/image-19.png\")
<\/a><\/p>\n