Threat Intelligence Brief
Curated summary with source attribution
Source: globalbankingandfinance.com
Threat Risk: High
Victim: Berlin State Government
Incident: Ransomware attack and data exfiltration.
Impact: Theft of 5.79 terabytes of sensitive government data, including classified info and passwords.
Attacker: Rhysida
Analysis: The Rhysida group successfully exfiltrated nearly 6TB of sensitive data, including contracts and classified information, from Berlin state agencies. While city officials maintain that election infrastructure remains intact, the scale of the breach indicates a significant failure in data perimeter defenses. The group’s decision to auction the data publicly demonstrates an aggressive monetization strategy when ransom demands are ignored.
Recommendations: Implement robust offline backups to ensure recovery without paying ransoms; Enforce multi-factor authentication (MFA) across all government agency access points; Conduct a comprehensive audit of sensitive data storage and access controls
Source: Reuters
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-31 18:33 UTC
Data exfiltration and ransomware attack by the Rhysida gang. Loss of administrative government data and potential exposure of personal records of thousands of individuals. Rhysida ransomware actors successfully exfiltrated data from the Senate Department for Mobility, Transport, Climate Protection and Environment. The attackers maintained access for approximately one week before detection, allowing them to move data out of the network before officials could disconnect affected systems. This incident highlights the typical discrepancy between exaggerated attacker claims and forensically validated breach scopes.
Corroborating source: tech-insider.org
Update — 2026-09-01 12:14 UTC
Ransomware attack and data exfiltration by the Rhysida gang. Exfiltration of 1.44 million files, including PII, passwords, and critical infrastructure vulnerability assessments. The breach targeted specific administrative departments, resulting in the theft of nearly 6TB of sensitive data. The inclusion of water supply vulnerability assessments and plaintext credentials suggests a deep penetration of the network. This incident highlights the persistent threat Rhysida poses to public sector entities globally.
Corroborating source: helpnetsecurity.com