Berlin Ransomware Leak Exposes 1.44M Files, Experts Urge Resilience
Image
Bremen – September 14, 2026 -- Ransomware group Rhysida published 5.79 terabytes of stolen data -- 1.44 million files -- from Berlin's state administration network BeLa on the darknet on September 4, after the city refused to pay a ransom of roughly €2 million. IT security consultancy team neusta and crisis communications specialist NetFed are citing the breach as a warning case for organizations of any size.
Attackers infiltrated two Berlin Senate administrations between August 7 and 12, 2026, copying data undetected for days before the intrusion into the BeLa network was discovered on August 14. The leaked dataset includes personal information on more than 12,000 individuals and emergency plans tied to critical infrastructure.