Rhysida Leaks Berlin Government Records After Refusing €2 Million Ransom Demand

A ransomware gang identified as Rhysida has released a trove of data from the Berlin state administration after the authorities declined to pay a two‑million‑euro ransom. The disclosed files contain personal information of civil servants and detailed emergency response plans, raising concerns about the security of critical public‑sector infrastructure.

The breach came to light after the group announced that its extortion request had been rejected. In response, Rhysida posted the dataset on a public leak site, allowing anyone with internet access to download the files. While the full extent of the compromised material has not been independently verified, the initial dump is said to include employee identifiers, contact details and internal documents outlining Berlin’s crisis‑management procedures.

Berlin’s authorities confirmed that they are investigating the incident and have engaged cybersecurity experts to assess the damage. The state government has urged affected employees to monitor their accounts for suspicious activity and has pledged to strengthen its defenses against future attacks. Officials emphasized that no evidence so far suggests that the leaked emergency plans have been exploited by malicious actors.

Rhysida’s tactics are consistent with a broader trend in which ransomware operators shift from encrypted lock‑outs to public shaming when victims refuse to meet payment demands. By exposing sensitive data, the criminals aim to pressure organizations into paying, while also generating notoriety within the underground cybercrime community. Analysts note that such “double‑extortion” schemes have become increasingly common, complicating incident response for both private firms and public entities.

The incident highlights the growing challenge faced by governments in safeguarding digital assets against sophisticated threat actors. While Germany has invested heavily in national cyber defenses, the breach underscores potential gaps in protecting employee records and contingency planning documents. Cybersecurity experts suggest that a combination of robust encryption, regular security audits, and rapid incident‑response protocols are essential to mitigate the risk of similar attacks.

As the investigation proceeds, Berlin’s leadership is expected to review its ransomware response policies and may consider legislative measures to enhance reporting requirements for cyber incidents. The fallout from the Rhysida leak could also prompt other German states to reassess their own data‑protection strategies, given the potential ripple effects of exposed emergency protocols on national security.