# Berlin Refuses to Pay Ransom for Stolen State Network Data Hackers stole 5.79 terabytes of data, Berlin stands firm against extortion demands. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-28 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/bb648047-476b-46fa-b23e-607daed46659 ## Attack Scale A cyberattack on Berlin's state network resulted in the theft of 5.79 terabytes of data. Hackers claim to have obtained personal information of 12,076 individuals. The data breach began in early August, occurring between August 7-12. Senate officials confirmed sensitive information might be among the stolen data. ## Rhysida Hacker Group The Rhysida group behind the attack previously targeted Stuttgart city administration and Welthungerhilfe aid organization. U.S. cybersecurity agencies had warned about their double extortion tactics in November 2023. The group leaked data through a dark web post titled 'Berlin, Germany' on their leak site. ## Government Response Berlin Mayor Kai Wegner declared the state won't yield to extortion after a special Senate session. Federal police and prosecutors are tracking the perpetrators. Election-related data remains unaffected and secure, officials confirmed. Forensic scanning of the state network continues. ## Ransom Policy CISA and FBI warn that ransom payments encourage attackers and don't guarantee data recovery. Berlin's decision aligns with these international recommendations. Experts emphasize network segmentation and multi-factor authentication as critical defenses. ## Affected Systems Housing benefit applications were temporarily suspended due to the attack. Two affected ministries were isolated from the network and reconnected on August 23. Senate maintains continuous communication with data protection authorities. Election systems were confirmed secure. ## Other Victims Rhysida has reportedly victimized 280 targets globally. Other German victims include Stuttgart city and Welthungerhilfe. Internationally, the Port of Seattle was attacked in 2024. The group shows connections to Vice Society and employs similar tactics. ## Data Types Stolen data includes 124,823 maps and geodata files, constituting about a quarter of total files. Hackers listed file categories but didn't disclose ransom amount. Berlin authorities continue investigating the full scope of compromised data. ## Sector Impact This incident highlights growing cyber threats against government networks. Manchester Airports Group recently disclosed a similar attack. Experts urge immediate protective measures for critical infrastructure. Berlin's firm stance may set a precedent for other institutions. ## Sources covering this story - https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._