Shortly before the elections for the Berlin Parliament, the hacker group Rhysida stole data, blackmailed the Berlin Senate and, after the bribery attempt failed, published the data on the Darknet.

It was news that almost went unnoticed, because the whole of Germany was focused on the regional elections in Saxony-Anhalt on September 6. However, the data theft in Berlin is a very serious event. It is connected to reports of attacks on critical infrastructure or drone attacks by hostile foreign powers on airports. The case of the German capital also shows how vulnerable data networks in Germany are.

What happened?
Since the beginning of September, personnel files, official documents, pay slips and scanned copies of identity documents have been visible on the Darknet. The hacker group Rhysida stole this data and then blackmailed the Berlin government. They demanded a ransom of 30 Bitcoins, which corresponds to around 2 million euros, promising that the sensitive data would not be published if the payment was made.

However, on Friday last week (04.09.2026), Berlin's Mayor Kai Wegner (CDU) declared: "Berlin will not allow itself to be blackmailed."

As a result, the data was published on the Darknet, the part of the internet that is only accessible to users with special technical knowledge. In total, it is about 1.4 million records.

An employee inadvertently opened a phishing email
Two government administrations of Berlin, a city of around four million inhabitants, are affected: the Building Administration and the Transport Administration.

This time it's not about foreign secret services, but about cybercriminals. Hackers managed to gain access, unnoticed, to protected data between August 7 and 14.

Rhysida is a cybercriminal group believed to have originated in Eastern Europe. Since 2023, it has attacked public institutions around the world and claims responsibility for nearly 280 attacks, particularly in the US.

An employee of the Berlin Transport Administration responded to a so-called phishing email, a fake message that looks very convincing. When the recipient opens one of the attached documents, they unwittingly give the attackers access to the organization's network.

In Berlin, the state administrative network connects around 600 locations via a secure fiber-optic infrastructure, from district offices to the Senate administration.

Publishing data could have serious consequences
The seriousness of this theft is made clear by the types of information that, according to experts, may have been compromised. In addition to the personal data of employees and citizens, it also concerns information on: heating and power plants, fuel depots, emergency power supply systems, prisons, water utilities.

Even for the affected individuals, publishing data, even on the Darknet, can have serious consequences. As Jochim Selzer from Chaos Computer Club told the Frankfurter Allgemeine Zeitung newspaper:

“The more I know about a person, the more accurately I can present myself as that person. I can also better assess what information I need to act on their behalf, for example to place an order.”

Debate over changing passwords
The Berlin government asked its employees to change their passwords, which caused outrage among the Police Union (GdP).

Its vice president, Thorsten Schleheider, stated that Berlin's data has been insufficiently protected for years and that many employees have not been sufficiently trained:

"It cannot be acceptable that for days highly sensitive data has been stolen and the only response seems to be to instruct employees to change their passwords."

Further measures from the Berlin Senate
Meanwhile, the Berlin Senate has set up a coordination center for all city administrations to deal with this data issue. Contacts have also been established with federal authorities such as the Federal Office for Information Security (BSI) based in Bonn.

Berlin's mayor, Kai Wegner, said: "We will inform, advise and support the employees and Berliners affected by this incident as soon as possible."

The September 20 elections are not in jeopardy
In at least one respect, Berlin authorities provided reassuring news: the elections for the Berlin Parliament on September 20 are not affected by the attack.

State Election Commissioner Stephan Bröchler told the Bild newspaper: "According to the current situation, the electoral environment has not been affected. This applies to the preparations, as well as to election day and the process up to the publication of the preliminary results."

Federal Chancellor Friedrich Merz (CDU) is also at least indirectly affected by this data theft. Among the stolen information are documents related to the controversial project to expand the Chancellor's Federal Headquarters in central Berlin./ DW