European Security — 2026-09-10

Rhysida Ransomware Group Leaks 6TB of Berlin Government Data Including National Defense Plans and CBRN Threat Files

BLUFExposed Bundeswehr crisis plans and CBRN frameworks pose an immediate operational security risk regardless of attacker motive, and German authorities are unlikely to revise their financially motivated attribution within 60 days.

The Rhysida ransomware group published roughly 5.7-6TB of data stolen from Berlin's state administration network on the dark web after the Senate refused a 30-Bitcoin (roughly €2 million) extortion demand, with the leak going live shortly after a Friday, September 4 deadline passed 12. Berlin's Senate Chancellery confirmed the intrusion, which hit the construction and transport departments, and said IT forensic experts are analyzing the roughly 1.44 million published files to identify and notify affected individuals 1. Investigative journalist Lars Winkelsdorf and the Tagesspiegel reported the trove includes national defense material, among it Bundeswehr crisis-response plans, federal emergency communication channel details, and a folder labeled "AG CBRN-Rahmenplanung" covering chemical, biological, radiological and nuclear threat scenarios, along with data touching power plants, fuel depots, substations, prisons, waterworks and defense-industry contractors 23. Germany's federal cybersecurity agency (BSI) said it currently sees no indication of a political motive and assesses the attack was financially driven, while Berlin's Senate said there is no evidence of ties to Russia or the Russian state 2.

Analysis
Berlin's crisis unit faces a compressed window to notify roughly 12,000 affected individuals and secure exposed CBRN and Bundeswehr crisis-response material before the September 20 state election sharpens scrutiny of the response. German and Berlin authorities are unlikely to revise their financially-motivated-crime assessment toward state-sponsored attribution within 60 days, since BSI reached its no-political-motive conclusion before forensic review of the 1.44 million files concluded and no attribution evidence has surfaced. A revision would require new technical indicators linking Rhysida's infrastructure to a state sponsor, which neither BSI nor the Senate has raised. Moderate confidence rests on a single primary Senate statement corroborated by consistent but non-independent secondary reporting, lacking forensic detail on attacker infrastructure. The leak's timing weeks before the election could still make this a hack-and-leak operation exploiting a financially motivated intrusion for political effect. Absent a shift to state attribution, the response stays confined to Berlin's LKA-led criminal probe and GDPR notification rather than escalating to a federal intelligence and diplomatic track.

5 sources

Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused - Infosecurity Magazine
Hackers Publish Data After Attack on Berlin's State Network - Berlin Spectator
Berlin cyberattack: hackers leak highly sensitive data across dark web - Euronews
Berlin Ransomware Leak Exposes State Secrets - Security Affairs
Aktuelle Lage nach dem IKT-Vorfall im Landesnetz Berlin und der Veröffentlichung der gestohlenen Daten - Senatskanzlei Berlin (Office of the Governing Mayor of Berlin)