Following a hacker attack on Berlin’s administration, the ruling mayor, Kai Wegner (CDU), has acknowledged that, based on the current findings, sensitive data may have been affected. This comes after the Senate initially stated that there were no indications of sensitive information being leaked, admitting that the “current level of knowledge is different.”
Wegner described Berlin as having become “a victim of a severe crime.” Immediate action was taken upon the attack’s discovery, involving federal security agencies, including the BKA and BSI. The State Criminal Police Office and federal security bodies are currently working to analyze the publically released and allegedly stolen data.
Although Wegner could not specify exactly what information was leaked, he confirmed that an investigation is ongoing in collaboration with the State Criminal Police Office and federal security agencies. The priority is to quickly identify and notify any potentially affected individuals.
Regarding the ransom demanded by the attackers-two million Euros-Wegner stated he had never considered paying it. “I am firmly convinced that I cannot allow myself to be extorted by a state. That is unacceptable,” he said. He also pointed out that one cannot guarantee data deletion even if the payment had been made, questioning whether the data might already exist elsewhere.
According to Wegner, the affected Senate administrations were isolated from the network immediately upon discovering the attack. He confirmed that once the event was recognized as a hacking incident, the two affected administrations were cut off, meaning the perpetrators could not download any further data according to current intelligence. Wegner noted that state networks are daily targets of cyberattacks, both in Berlin and across Germany, though most of these attacks are successfully blocked-while this instance was not.
Wegner was unable to assess the total damage or compare the severity of this incident to the Berlin power outage in January 2026, stating that they first need to determine precisely which data was leaked and who is affected.
In response to the sensitive administration data being published on the darknet, the Federal Government has conducted an intensive review of its own data systems. A government spokesperson told “Bild” that the federal government is closely monitoring the data leak investigations. Relevant federal and state security agencies are exchanging information continuously via the National Cyber Defense Center. Following the analysis of potential security risks, measures related to national security are being implemented. As of now, the Federal Government’s data systems have not been affected.
The backdrop to this crisis is the recent cyberattack on the Berlin state network, where the “Rhysida” hacker group released approximately 1.4 million unencrypted files. This release occurred after the state of Berlin refused to make any ransom payments. Authorities are currently coordinating defensive measures due to the sensitive infrastructure plans included within the leaked files.
