Berlin's official 31 August update says the city is facing extortion after the mid-August cyberattack on its administrative network and will not pay.

Forensic work confirmed data left the Senate Department for Mobility, Transport, Climate Protection and the Environment between 7 and 12 August; the scope is still being assessed and personal or other non-public data may be involved.

Berlin says the affected departments were disconnected on 14 August and investigations by state police, prosecutors and federal security authorities continue.

BleepingComputer reports that the Rhysida ransomware group claimed the attack; Berlin's notice does not attribute the incident.

UPDATE (22 Oct 2026): the stolen data has since been published. The Senate Department for Mobility, Transport, Climate Protection and the Environment's data-incident page now says analysis of the published data is still under way and warns affected people about darknet-related scams. rbb24 reported on 21 October that Rhysida had published data from two Berlin Senate departments, including ID-card copies of staff and of the department's senator Ute Bonde; the department confirmed to rbb that Bonde is affected and said the stolen data is mostly unstructured data from shared and personal staff folders. (source: rbb24, 21 Oct 2026; berlin.de SenMVKU data-incident page)

Correction (23 Oct 2026): removed the reference to the ransomware group's own claim of a much larger theft. (source: https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/)