Berlin cyberattack: hackers leak highly sensitive data across dark web
Hacker attack on the German capital. The massive cyberattack on Berlin's regional administration has escalated: almost six terabytes of data, including highly sensitive files, have surfaced on the dark web.
By Nela Heidner & Euronews
Published on 05/09/2026 - 9:17 GMT+2
The hacker group "Rhysida" has published almost six terabytes of data from Berlin's state administration on the dark web. Among them are said to be highly sensitive information. The scale of the leak is enormous: 1,439,893 files. So far there has been barely any response from Berlin's administration and political leaders.
Among the published files is a folder titled "AG CBRN-Rahmenplanung". CBRN stands for chemical, biological, radiological and nuclear threats. This means that highly sensitive information about potential threat scenarios may now be publicly accessible and could also be viewed by terrorists or foreign intelligence services.
Investigative journalist Lars Winkelsdorf has sounded the alarm on "X". According to him, this cyberattack is "of a magnitude that threatens the state": "Alongside files from the LKA relating to investigations, it also contains plans that concern a state of defence, up to secret communication channels of the federal government for the event of the end of the world."
A large amount of personal data has also leaked, particularly relating to state civil servants. This includes birth certificates, what appear to be absence lists, telephone numbers and home addresses.
The extortionists had previously threatened publication on their leak site and demanded a ransom of 30 Bitcoin, around two million euros. They set a countdown that expired at about 3.35 pm on Friday. The Berlin Senate had already made it clear before the ultimatum expired that, as a matter of principle, it does not give in to such blackmail demands, and it ignored the demand.
Shortly after the countdown ended, the leak followed: the huge data package was published on the dark web. On social networks, members of the hacking group were already circulating lists of file names, indicating how extensive the attack was and how much data has now been siphoned off.
