The State of Berlin confirms that a group copied data from its administrative network and published it on 4 September 2026 after an extortion attempt that the city refused. The systems of the two affected Senate departments had been isolated on 14 August. As of 29 September, Berlin says analysis of the published data and identification of affected people are ongoing.
The story needs to be read in layers. The incident on the state network, the data outflow and the extortion attempt are established by the authorities. The attacker’s identity, the exact volume and the list of documents attributed to the group must still be separated from the criminals’ statements and media reporting.
What Berlin confirmed in late August
Berlin’s 28 August statement says that forensic work identified additional data outflows in the area of the Senate Department for Mobility, Transport, Climate Protection and the Environment. Authorities place those outflows between 7 and 12 August, before the affected administrations were separated from the network on 14 August. They also say that personal or other non-public information may be involved, without publishing a detailed list.
The same statement confirms Berlin’s position on the extortion demand: the state will not pay. At that point, Berlin did not disclose the amount demanded or the identity of those responsible. Rhysida’s name came from the group’s claim and press reports; it should not be rewritten as a final judicial attribution.
Two Senate administrations, concrete service disruption
The investigation concerns two Senate administrations: the department responsible for mobility, transport, climate and the environment, and the department responsible for urban development, construction and housing. Their disconnection had concrete but localized effects. The Friedrichshain-Kreuzberg district office reported, for example, that traffic orders and technical special-use requests linked to construction could not be viewed or processed when the procedures depended on the first department.
That distinction matters. This was not only a story about allegedly stolen files: a technical dependency can delay a public procedure. But a disruption in selected workflows does not mean that every Berlin service or the election environment was compromised. Continuity needs to be measured procedure by procedure, with clearly communicated fallback channels.
What Rhysida claims, and what it does not prove
In its 3 September update, Berlin said that Rhysida claimed the attack and alleged possession of 5.7 terabytes of data. The alleged attackers offered the data in an auction with a minimum bid of 30 bitcoin, described in the statement as approximately two million euros. Berlin warned that publication could follow on 4 September.
The 5.7 terabytes cited by Berlin on 3 September was the volume Rhysida claimed, not an official tally of affected people or documents. Tagesschau reported that the published archive held around 1.44 million files and 5.8 terabytes: a file count is not a count of victims. As of 29 September, Berlin says the data mostly consists of unstructured files from shared and personal directories, rather than specific line-of-business applications. Personal data belonging to staff, residents and companies may nevertheless be included.
After publication, assess before alarming people
Berlin’s official incident portal, updated on 29 September, says the published files are still being analysed and people or groups will be notified once the evidence allows. For questions about SenStadt, the department lists Datenschutzvorfall@SenStadt.berlin.de; for SenMVKU, Datenschutzvorfall@senmvku.berlin.de. SenMVKU’s data-breach notice also lists several groups already identified, including people registered for the STADTRADELN campaign between 2023 and 2026. This does not mean that everyone connected with Berlin is affected: scope depends on the department and the files under review. Berlin lists Cyberangriff@senatskanzlei.berlin.de for other questions about the attack.
This approach also protects public services. Teams can keep essential procedures running on isolated systems, preserve evidence, revoke the access that is actually affected and separate data analysis from production recovery. Berlin is continuing its review; until it is complete, the lack of information about a particular person neither confirms nor rules out that they are affected.
Practical steps for staff, residents and suppliers
People who deal with the two administrations should be cautious of messages that reuse a real case, address, procedure or exchange to request a code, payment or new document. Open the administration’s website or phone number from a known source. Do not search for the files on the Dark Web or redistribute them: doing so adds legal and operational risk without helping identify the people actually affected. For current guidance, use Berlin’s official incident portal; people whose data is handled by SenMVKU can also read its notice on affected groups.
If personal data is published or used for fraud, Berlin advises filing a police report, including through the Berlin police online portal. Staff should follow their administration’s instructions, change any secret reused on another service and report unusual requests. Suppliers and companies working with the affected services should verify changes to contact or payment details through a second channel and review accounts held by authorized staff.
The link with Soclyde
Soclyde does not protect Berlin’s state network, classify the published files or replace the authorities’ investigation and continuity work. Its role is narrower: keep access details in an encrypted vault and help people use a distinct secret for each service. It cannot reveal whether someone appears in the stolen files or replace official notifications.
That separation limits cascading damage. It does not make administrative data unexposed and it does not replace MFA, backups, network segmentation or incident response. It simply prevents one uncertain leak from becoming confirmed access to other accounts through password reuse.
Key takeaways
Berlin confirms that data from its administrative network was published, but analysis of its contents and identification of affected people are still underway. Reported volumes describe files, not a number of victims, and the attribution to Rhysida remains tied to the group’s claim. Check Berlin’s official portal and follow notices from the relevant department rather than searching for the published files.
To prepare that rotation without scattering passwords, read our secure password generator guide or contact Soclyde.
For handling shared access with clear sharing and revocation rules, see our guide to secure team password sharing.
