What Happened?
The cyberattack on parts of the Berlin city administration is developing into one of the most severe known IT security incidents at the state level in Germany to date. Since September 4, 2026, around 1.44 million files totaling 5.8 terabytes have been published on the darknet. Initially, authorities and the public assumed that mainly personal data such as scanned passports, employment contracts, job application documents, and sick notes were affected. Meanwhile, however, mounting evidence suggests that highly sensitive information on critical infrastructure, civil protection, and defense companies was also leaked.
The Details
The attack began as early as between August 7 and 12, 2026, when unknown attackers gained undetected access to the state network of the Senate Departments for Urban Development, Building and Housing as well as for Mobility, Transport, Climate Action and Environment, and exfiltrated data. The attack was only noticed on August 14, after which the affected departments were isolated from the state network. Three days later, the Senate Chancellery informed the public about an "ICT incident in the Berlin state network," an emergency crisis team was set up, and the Federal Criminal Police Office (BKA), the State Criminal Police Office (LKA), and the Federal Office for Information Security (BSI) were brought in.
In the following weeks, there were significant disruptions: around 50,000 eligible households in Berlin were temporarily unable to receive housing benefit payments. It was not until August 24 that all affected parts of the Senate administration were back online. On August 28, a ransom demand emerged – the ransomware group "Rhysida" demanded 30 Bitcoin, equivalent to around two million euros. Governing Mayor Kai Wegner stated that the state of Berlin would not give in to extortion. After the ultimatum expired, the perpetrators published the data.
According to research by the Chaos Computer Club and media reports by Der Tagesspiegel, the leaked files also include information on Berlin's water supply, heating power plants, fuel depots, emergency power systems, substations, prisons, waterworks, as well as on defense companies and the German armed forces (Bundeswehr). In addition, plaintext passwords, judicial records, and more than 46,500 state contracts were exposed. A complete overview of the volume of data is not yet possible, as the content cannot easily be searched.
Assessment
Politicians and experts have expressed alarm. Green Party deputy parliamentary group leader Konstantin von Notz described the incident in Handelsblatt as a "genuine data meltdown" and warned of potentially significant financial consequences for taxpayers. He also sees shared responsibility on the part of the federal government and does not rule out personnel consequences should it emerge that protective mechanisms were deliberately disregarded. CDU foreign policy expert Roderich Kiesewetter described the data breach to Süddeutsche Zeitung as a threat to national security.
IT expert Manuel Atug accused the state of Berlin of gross negligence, stating that he had already pointed out glaring security gaps as an expert witness to the Berlin Committee on Internal Affairs in 2023 and 2025. The BSI warns of an elevated threat level for society, as security-relevant information on critical infrastructure could be exploited by hostile foreign powers or terrorists.
For the security technology industry's target audience, the case illustrates how closely physical and digital security are now intertwined: if data on emergency power systems, substations, or waterworks is publicly accessible, this potentially also affects operators of access control systems, alarm systems, and video surveillance at these sites.
Practical Tips
- Affected citizens, employees, and businesses should take seriously the announced contact from the newly established coordination unit via letter or email and follow the instructions provided.
- The Chaos Computer Club warns of identity theft and extortion attempts – those affected should be especially vigilant regarding unexpected contact that references personal data.
- Since plaintext passwords were also exposed, employees of affected administrations—and generally anyone who has linked access credentials to government accounts—should change these immediately.
- Given the possible publication of detailed information on facilities such as substations or emergency power systems, operators of critical infrastructure should review their physical protective measures, including access control and perimeter security.
Outlook
Forensic investigations and inquiries are ongoing, and a complete overview of the scope and content of the leaked data is not yet available. In addition to the BSI, BKA, and the Federal Office for the Protection of the Constitution, the Joint Cyber Defense Center is also involved in the follow-up. The Bundeswehr announced that it would implement measures to protect military security once the risk analysis is complete. The Berlin state government states that it has already increased its security measures.
The incident takes on particular significance given the upcoming Berlin House of Representatives election in two weeks. State election officer Stephan Bröchler stated that the election infrastructure is not currently affected—however, given the scale of the leak, IT security is likely to also become an issue in the election campaign. The case illustrates, in exemplary fashion, the far-reaching consequences that inadequate confidentiality protection standards in public administration can have—a lesson that is also relevant for operators of security-critical facilities outside of government.
