Berlin's state government has activated a central crisis response after the Rhysida ransomware group published data it claims was stolen from two government departments.
Authorities said on Saturday, September 5, that they were reviewing the material, verifying what is genuine and assessing who may be affected. The release came less than a month before Berlin's September 20 city-state election.
What the hackers published
Reuters reported that a Rhysida auction offering 5.79 terabytes of data ended on Friday. The starting price was listed as 30 bitcoin, which Reuters valued at $77,622 at the time. Berlin had already said it would not pay extortion demands.
Publication on a criminal leak site does not prove every file is authentic. The government's crisis unit must separate legitimate records from duplicated, altered or unrelated material before it can judge the damage.
What Berlin's crisis unit will do
The unit will coordinate technical analysis, verify the exposed data and help government offices notify affected residents and businesses. European and German data-protection rules require relevant authorities to inform individuals when a confirmed breach creates a risk to them.
Berlin described the incident as an attack on the state and urged the public not to spread unverified claims. That warning is especially important during an election period, when genuine stolen material can be mixed with false documents or misleading interpretations.
What residents should watch for
People who have dealt with the affected departments should be alert for official notices, unexpected password-reset messages, phishing emails and calls requesting personal information.
Do not use a link sent in an unsolicited message to “check” whether your data was exposed. Visit the agency's official website directly. Reusing passwords is particularly risky after a breach; unique passwords and multi-factor authentication reduce the damage if login details circulate.
Why ransomware leaks are different
Traditional ransomware encrypted systems and demanded money for restoration. Many groups now also steal files and threaten publication, creating a second crisis even when backups allow services to recover.
Berlin's investigation is ongoing, so the confirmed scope may change. Claims made by the attackers should not be treated as verified government findings.
