Berlin’s state administration is dealing with a major cyberattack after criminals gained access to parts of the city’s government network and stole data.
The attackers are demanding around €2 million, but the Berlin government says it will not pay.
What happened?
According to the Berlin Senate, data was taken from government systems between 7 and 12 August 2026.
On 14 August, two affected departments were disconnected from Berlin’s state network:
- The Senate Department for Urban Development, Building and Housing
- The Senate Department for Mobility, Transport, Climate Protection and the Environment
Investigators are still examining how much data was stolen and exactly what it contains. Berlin officials say personal or other non-public information may be involved. Berlin’s official statement
What are the hackers demanding?
A ransomware group called Rhysida has claimed responsibility for the attack.
The group is demanding 30 Bitcoin, worth approximately €2 million, and has threatened to sell or publish the stolen information.
Rhysida claims to have obtained around 5.79 terabytes of data, including contracts, emails, telephone numbers, passwords and confidential documents. However, the full amount and content of the stolen data have not yet been independently confirmed. Reuters report
Were public services affected?
The cyberattack temporarily caused problems with several administrative services.
These included restrictions affecting online postal-vote applications and the processing of housing-benefit applications. The affected departments have since been reconnected, but additional security checks and restrictions remain in place.
Is the Berlin election affected?
Berlin officials say there is currently no evidence that election-related data was stolen.
According to Interior Senator Iris Spranger, the technical systems used for Berlin’s state election remain secure.
What should Berlin residents do?
The authorities have not announced that all residents need to take specific action. However, because personal data may have been stolen, people who have recently contacted Berlin authorities should be careful with unexpected emails, calls or payment requests.
- Do not provide passwords or banking details by email.
- Check the sender’s complete email address.
- Do not open unexpected attachments or links.
- Verify suspicious requests by contacting the relevant authority through its official website or telephone number.
Stolen information could potentially be used to make fraudulent messages appear more convincing. RBB report on the possible risks
What happens next?
Berlin’s State Criminal Police Office, the public prosecutor and federal security agencies are investigating the attack.
Governing Mayor Kai Wegner has rejected the ransom demand, saying that the State of Berlin will not allow itself to be blackmailed. The forensic investigation of the government network is continuing.
Last updated: 3 September 2026