Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved

In August–September 2026 the Rhysida extortion group breached two Berlin Senate administrations, exfiltrating roughly 1.44 million files (the leak-site lists 5.26 TB; the actor claims 5.79 TB) comprising office documents, mailboxes and thousands of sensitive secrets (certificate/key stores, password safes, and plaintext credentials). Berlin confirmed the theft and refusal to pay the 30 BTC ransom; the archive was publicly released on September 4. The report emphasizes that the most dangerous fallout is exposed secrets enabling credential reuse and follow-on intrusions, outlines forensic and notification challenges, and provides remediation guidance (rotate certificates/credentials, segment networks, and prioritize notification and monitoring).