Berlin government network hit by Rhysida ransomware: nearly 6TB of administrative data stolen
Berlin's BeLa government network was breached by the Rhysida ransomware group. Attackers claim theft of nearly 6TB of data, including administrative records, contracts, infrastructure documents, and login credentials.
Rhysida ransomware has another high-profile target: a serious security incident on Berlin's government network. The BeLa government network, which connects hundreds of administrative offices, was compromised by the Rhysida group. Attackers claim they stole nearly 6TB of data, including administrative records, contracts, infrastructure-related documents, plus passwords and login credentials.
Incident overview
BeLa is the backbone network of Berlin's municipal administration, connecting hundreds of government offices. Rhysida publicly claimed responsibility and said it obtained about 6TB of data. If the leak is authentic, administrative records and contract documents can fuel targeted social-engineering attacks, while credential and password exposure means some connected systems may remain in a credential-compromise state for an extended period.
Technical details
Rhysida is an active ransomware-as-a-service (RaaS) group that typically uses double extortion: steal data first, then encrypt systems, using public leaks as leverage. Intrusions into government networks usually start with credential abuse or edge-device exploitation, then move laterally to file servers and backup systems. Full technical details of this incident are not yet public. Berlin officials have not disclosed the initial access vector or the full blast radius.
Impact assessment
Government-network data leaks have compound effects: (1) leaked administrative records and contracts can expose weak controls and sensitive partnerships; (2) infrastructure documents that circulate in attacker communities can be used to plan follow-on targeted attacks; (3) credential leaks let attackers retain residual access even after incident response. A volume of nearly 6TB also suggests a non-trivial dwell time on the internal network.
Security recommendations
This incident is relevant to all organizations, not only government agencies:
- Rotate credentials network-wide, prioritizing domain admins and service accounts;
- Verify backup isolation and integrity; confirm ransomware did not reach backup copies;
- Audit edge-device (VPN, remote-access gateway) logs for anomalous logins;
- Trace access paths to sensitive documents and assess which data may already have exfiltrated;
- Enable MFA and shrink the remote-access surface to reduce the blast radius of credential leaks.
Sources
- Zinbiel Daily Security Brief (2026-08-31)
About Rhysida
Rhysida's first activity dates to 2023. Targets span healthcare, education, manufacturing, and government. The group has hit multiple healthcare providers and local-government systems. It typically posts partial stolen data on a dark-web leak site as proof of pressure. Ransom demands range from hundreds of thousands to millions of dollars depending on target size. For government targets, leaked content often includes large volumes of resident-related administrative data; secondary risk is higher than in typical enterprise incidents.
Implications for SMBs
Large government networks are not the only ransomware targets. Groups such as Rhysida typically select on "weak defenses + valuable data + ability to pay or pressure to recover." SMBs fit that profile. Baseline controls remain the highest-ROI investment: regularly exercise backup restore, shrink remote-access entry points, enable phishing defenses and MFA, and apply least privilege to admin accounts. The bulk of ransomware loss is usually not the ransom itself, but downtime and data-rebuild cost.