Berlin cyberattack: Was my data leaked, and what should I do?

The ransomware group Rhysida has now published 1,44 million files of Berliners’ data on the dark web. What steps can Berliners take to ensure their personal information isn’t further compromised?

Rhysida uploads stolen Berlin data

Between August 7 and 14, the Rhysida hacker group accessed the computer systems of Berlin’s Department for Urban Development, Construction and Housing and the Department for Mobility, Transport, Environment and Climate Protection and stole 1,44 million files of Berliners’ data.

The group then demanded a ransom of 30 bitcoins (around 2 million euros), and said it would upload the data to the dark web unless it received the money by September 4. The Berlin government did not meet Rhysida’s demand, and the 5,8 terabytes of data were uploaded to the encrypted dark web.

Speaking to local public broadcaster rbb, IT security expert and Chaos Computer Club member Bianca Kastl explained that Rhysida has been active since 2021 and was already known to security authorities. 

The group - which, according to the Federal Office for Information Security (BSI), is motivated by money rather than political influence - used similar tactics to hack and blackmail authorities in Stuttgart in May 2026.

In 2023, the group also attacked the British Library, which saw a weeks-long system outage as a result, and the German charity Welthungerhilfe.

Which data was leaked?

According to the Chaos Computer Club, the leaked data includes personal information about administrative staff, such as personnel matters, employment references and emergency plans.

However, Chief Digital Officer Florian Hauer told taz that, because of the sheer amount of data which was stolen and published, authorities are still trying to get a handle on what information has been compromised.

Hauer added that authorities do know that the leaked data is considered to be on the lowest of four secrecy levels, and the leak doesn’t pose a threat to national security.

That said, according to a Tagesspiegel report, the hackers have published information about key infrastructure facilities, such as combined heat and power stations, fuel depots, emergency power systems and substations.

The Berlin-based newspaper reported that leaked information also included data on prisons, defence contractors, the Bundeswehr and the Berlin Interior Administration. According to Chaos Computer Club, documents and sensitive information about Berlin’s water supply were also stolen.

The hack comes as authorities in Berlin and other federal states face a growing threat of sabotage on critical infrastructure. According to a recent Süddeutsche Zeitung report, authorities have registered 165 suspected sabotage cases so far in 2026.

What steps should Berliners take?

So what does the hack mean for Berliners? The people most at risk of having had their data stolen are those who have been in contact with the two affected authorities: the Department for Urban Development, Construction and Housing and the Department for Mobility, Transport, Environment and Climate Protection.

The Berlin Commission for Data Protection and Freedom of Information (BInBDI) recommends taking several steps to ensure your information is not further compromised:

• Change your passwords (especially for government service accounts)
• Check your bank statements
• Stay alert to potential phishing attempts
• Do not open any links in unusual emails, nor any emails from unknown senders or with unusually structured email addresses (e.g. Bank@34ölkj.de)
• Do not make blackmail payments; instead, contact the police
• Document suspicious activity

In the event of unauthorised use of bank accounts, Girocards (EC cards), credit cards, mobile phone numbers or e-IDs: call the emergency blocking helpline on 116 116 and report the matter to the police.

Alongside phishing attempts, Joachim Selzer of Chaos Computer Club told Tagesschau that the biggest risk following a personal data leak is identity theft. 

“The more I know about a person, the more accurately I can impersonate them, and the more accurately I can also assess what I need to know about that person – for example, to be able to place an order on their behalf.”