Full Breakdown
Berlin Mayor Refuses Ransom After Pre-Election Cyberattack
8/29/2026, 12:01:31 PM
Core Event: Hackers Breach City Network and Issue Blackmail
In early August 2026, the Berlin Senate’s computer network was infiltrated by the ransomware group known as Rhysida. The attackers exfiltrated data between August 7 and August 12, then forced the shutdown of two departmental networks on August 14, disrupting online services for housing benefits and payments. The group subsequently demanded a ransom and announced plans to auction the stolen files.
Background & Context: Election Timing and Prior Threats
The breach occurred less than a month before Berlin’s state parliamentary election scheduled for September 20. Governing Mayor Kai Wegner, a member of the Christian Democratic Union who announced in July that he will not seek another term, and Senator for the Interior, Digitalisation and Sport Iris Spranger faced pressure to assure the public that the election infrastructure remained secure.
Timeline of the Attack
| Date | Event |
|---|---|
| August 7 – 12 | Initial data exfiltration from the Senate network (reported by the mayor’s office). |
| August 14 | Shutdown of the Senate Department for Mobility, Transport, Climate Protection and the Environment and the Senate Department for Urban Development, Construction and Housing; online applications for housing benefits halted. |
| August 28, 2026 | Mayor Wegner and Senator Spranger held a press conference, declaring that Berlin would not submit to extortion. |
| September 20 (scheduled) | Election of a new Berlin state parliament. |
Data & Statistics: Scope of Theft and Ransom Demand
- 5.79 terabytes of data were claimed to have been stolen, according to a statement on Rhysida’s website.
- The group announced an intended auction of the data within seven days, starting at 30 bitcoin (approximately €2 million).
- The compromised files reportedly include contracts, non-disclosure agreements, personnel records, passwords and thousands of personal contact details.
Official Statements & Responses
- Kai Wegner said, “Berlin will not be blackmailed,” and affirmed that state police, prosecutors and federal security services were investigating the incident “with the utmost urgency.”
- Iris Spranger added that the city’s election infrastructure had not been affected and that no election-related data appeared to be compromised.
Conflicting Reports & Gaps
- Der Spiegel reported that the ransom demand was 30 bitcoin (? €2 million).
- Several outlets, including the mayor’s office, did not disclose the amount of the ransom, stating only that a demand had been made.
Why It Matters
The cyberattack highlights the vulnerability of municipal digital infrastructure ahead of a major democratic exercise. Disruption of housing-benefit applications illustrates immediate service impacts on residents, while the threat of publicizing personal data raises privacy concerns. The refusal to pay the ransom underscores Berlin’s policy of not yielding to extortion, a stance that may influence how other German states and EU municipalities respond to similar threats. The incident also places the upcoming election under heightened scrutiny, as candidates and parties must address cybersecurity preparedness while maintaining public confidence in the electoral process.
