In October 2026, Berlin’s Senate Chancellery confirmed that there have been no new attacks on the affected network sections since August 13, and the attackers did not manage to maintain access. Authorities are still reviewing the 1.4 million data records published on the dark web after Berlin refused to pay the ransom, checking what information was exposed and how sensitive it is. Criminal investigations are ongoing, and Berlin is continuing to improve its IT security.
What the Original Attack Involved
When we first covered the Berlin Rhysida attack in August 2026, the key facts were these: Rhysida, a Russian-linked ransomware-as-a-service operation, breached Berlin’s government network between August 7 and 12, 2026. The two departments most affected were the Senate Department for Transport and the Environment and the Senate Department for Urban Development, Construction and Housing, both of which operated their own section of Berlin’s Landesnetz backbone network independently of the city’s main IT provider.
Rhysida demanded 30 bitcoin, roughly two million euros, or approximately $2.3 million. Berlin’s Governing Mayor Kai Wegner publicly refused. “The state of Berlin is being blackmailed,” he said then. “We will not comply with the attackers’ demands.”
The refusal meant the ransom countdown ran to zero. When Rhysida’s deadline expired, the group published the stolen data on its dark web leak site. The publication included 1.4 million data records across 1.44 million files, including personal records on 12,076 individuals, contracts, email addresses, phone numbers, and, critically, what some researchers identified as water-supply vulnerability assessments and internal infrastructure documentation.
What “Immediate Threat Averted” Actually Means
The Senate Chancellery’s October update uses careful wording that is worth explaining.
“The attacker did not succeed in infiltrating the network on a sustained basis.” This means Rhysida did not establish persistent access: no backdoor, no ongoing connection, no tool left behind waiting to be reactivated. The August shutdown of the affected network sections, which happened on August 14, successfully cut the connection before the attacker could embed themselves more deeply.
This is an important technical outcome. If ransomware groups manage to keep access to a network, they can come back even after the first attack is fixed, using the access they set up earlier. Berlin seems to have prevented this from happening.
No further attacks on the affected sections since August 13.” This matches the timeline: Rhysida took data from August 7 to 12. Disconnecting the network on August 14 closed the way in. Since then, there have been no new intrusions on those parts of the network. The immediate risk to operations is over. This attacker no longer has access through this route.
What Is Not Resolved: The Dark Web Publication
This part of the update is more troubling.
Berlin did not pay the ransom. This was the right choice because paying ransomware groups supports future attacks and does not guarantee that stolen data will be deleted or kept private, as has been shown many times in 2026. However, not paying means that 1.4 million records are now publicly available on Rhysida’s dark web leak site.
The Senate Chancellery confirmed that the stolen data “would continue to be analyzed.” In practice, that means forensic investigators are working through the published dataset to determine which records are accurate, which may be outdated or incorrect, and which individuals or partner organizations need to be notified and potentially protected.
This process is slow. Reviewing 1.4 million records in different categories—personal data, contracts, infrastructure documents, and emails—cannot be finished in just a few weeks. Meanwhile, these records are on the dark web and have probably already been copied, downloaded, and shared across various criminal networks.
As we’ve covered in our guide on whether data can be removed from the dark web and in our piece on what to do when personal data is exposed, the publication of a dataset on a ransomware group’s leak site is effectively permanent. The files get downloaded, shared to forums, sold in criminal markets, and accessed by parties entirely separate from the original attacker. Removing the listing from Rhysida’s site, which has continued to operate throughout this period, would not recover files already distributed.
What Happens to People Whose Data Was Published
The 12,076 individuals identified in the dataset as having personal records in the publication represent the most immediately affected group. But the actual number of people at risk is likely larger because the 1.4 million files also include internal documents, contracts, email correspondence, and infrastructure data that may reference many more individuals not counted in that direct personal data figure.
For anyone who received official notification that their data was in the published dataset, the risk profile depends on what was included. Personal home addresses, combined with phone numbers and professional context, which government department records often contain, create targeting opportunities for social engineering, impersonation, and phishing. Because the data comes from government records, it carries an air of authenticity that makes it useful to criminals building convincing pretexts.
The “continue to be analyzed” work the Senate Chancellery is doing includes, presumably, identifying those individuals who need additional protective action on their records within government databases, flagging accounts for enhanced verification, adding protective notes, and in some cases advising individuals to be particularly vigilant about communications that reference their government interactions.
Criminal Prosecution Is Still Active
The Senate Chancellery confirmed that criminal prosecution proceedings are being pursued. This aligns with the broader pattern: investigations into Rhysida remain ongoing at the federal and international levels, coordinated through the State Criminal Police Office (LKA), the public prosecutor, and federal agencies including the Federal Office for Information Security (BSI).
Rhysida has had a prolific 2026, with approximately 280 confirmed victims across 39 countries at the time of the Berlin attack, including previous German victims like Stuttgart’s city administration and the humanitarian aid organization Welthungerhilfe. The group operates as ransomware-as-a-service, so attribution and prosecution require working through both the infrastructure operators and the affiliates who run individual attacks.
CISA’s advisory AA23-319A on Rhysida, which remains the authoritative public technical reference for the group’s tactics and indicators, notes that the FBI and international partners are actively tracking the operation. No arrests connected specifically to the Berlin attack have been publicly announced.
IT Security Measures Are Continuing
The Senate Chancellery confirmed that “measures to protect information technology would continue to be implemented and strengthened.” This is the organizational consequence of any significant incident: the security architecture that allowed one phishing email to open a seven-day window for data exfiltration doesn’t automatically close when the attacker is removed.
Berlin’s approach to cybersecurity across its government network has faced scrutiny since the attack, particularly because the two affected departments operated their network infrastructure independently of ITDZ Berlin, the city’s main IT provider. Independent operation meant independent (and evidently less robust) monitoring.
The remediation work includes not just patching the specific vulnerability that Rhysida exploited, but addressing the broader architectural gap between departments running their own network segments and the central monitoring that could have detected unusual data flows earlier.
Frequently Asked Questions
Is the Rhysida attack on Berlin fully over?
The immediate network threat is resolved; no further intrusions have been detected since August 13, and Rhysida did not achieve sustained network access. However, 1.4 million published data records remain on the dark web and are still being analyzed.
Did Berlin pay the ransom?
No. Governing Mayor Kai Wegner refused to pay. After the deadline, Rhysida published the stolen data.
What data was published?
The published data includes 1.4 million files: personal records for 12,076 people, government contracts, emails, phone numbers, addresses, and internal infrastructure documents.
Is there ongoing risk?
Yes. The published data is permanently available on the dark web and has probably been shared further. People whose data was included are still at risk for targeted phishing and social engineering.
Are criminal proceedings continuing?
Yes. Berlin’s state criminal police, prosecutors, and federal security agencies are working on the case, together with CISA’s Rhysida advisory and international law enforcement partners.
