The Berlin Ransomware Attack: Rhysida, 5.79 TB, and the Real Cost of Public-Sector Ransomware

The Nisura Team · 8 September 2026 · Updated 21 September 2026

In mid-August 2026, the ransomware group Rhysida breached two departments of the Berlin Senate connected to the state network, the Landesnetz. Berlin refused the ransom — and the attackers dumped roughly 1.44 million files (about 5.79 TB) on the dark web anyway. It is the clearest recent illustration of two things that decide the real cost of a breach: operational downtime and regulatory liability — not the malware, and not the ransom figure everyone quotes.

The timeline

Every date below is verifiable. The backbone is heise’s own dated chronology (which links each event to its individual report), cross-checked against the official Berlin Senate statement, the BSI, Reuters and Tagesschau. The dates that matter most are the gap between exfiltration and containment, and the weeks of downtime that followed.

A note on that last point: the “only VS-NfD” assessment is the Senate’s, and it is disputed. Several outlets stress that what was actually stolen — and how the attackers got in — is still not fully established. The honest reading is that the blast radius is not yet known.

How they got in: phishing, a fake captcha, and a pasted command

There was no exotic zero-day. According to the BSI — which confirmed the vector on Mastodon, citing a Microsoft analysis — the entry point was a campaign called “TerminalFix,” a variant of the well-known ClickFix technique (we break the full chain down step by step in a dedicated explainer). The chain is almost entirely human-operated:

• A phishing lure sends a user to a manipulated website showing a fake Cloudflare captcha.
• The “captcha” instructs the victim to open the Windows Terminal and paste a command the page has quietly placed on their clipboard — which runs PowerShell and downloads the first-stage malware.
• The malware sideloads through a signed Windows binary, hides further payloads in PNG images via steganography, persists via registry keys, and opens a SOCKS proxy tunnel into the network.

From there, one detail made the attackers’ job far easier: the Berlin administration, by its own confirmation, kept plaintext password lists. This is exactly the scan-invisible, credential-and-human path that a CVE-only view of risk misses — and the one Nisura prices as a distinct vector.

One caveat, for accuracy: the BSI attributes the initial vector to TerminalFix, but the complete path by which the attackers reached apparently all the data of two departments is still under forensic investigation. Rhysida — a ransomware-as-a-service operation active since 2023 (CISA advisory AA23-319A) — is known to use compromised credentials, phishing and exposed remote access interchangeably, so treat single-cause explanations with care while the analysis continues.

Why Berlin was so exposed — the part that should worry every public body

The lure landed, but what turned one click into a two-department breach was structural. Berlin’s administration runs on IT grown over decades into a patchwork — and the two Senate departments that were hit ran their own infrastructure, outside the state’s central IT service provider (ITDZ) that otherwise operates and secures the Landesnetz. The state’s information-security guidelines had reportedly not been revised since 2017; its dedicated public-sector cyber strategy was barely a year old and, by the time Rhysida struck, largely unexecuted; and the Chief Digital Officer role had turned over three times in roughly a year, the current holder filling it only as a side office. Strategy on paper was not the same as control in practice. (After the breach, the governing mayor pledged to “harden” the state network, centralise the administration’s IT and make “all personnel and financial resources” available — without waiting for a new coalition to form.)

The recovery is proving just as fragmented. To run the forensics, the Senate engaged CrowdStrike — and one district, Lichtenberg, refused to deploy its Falcon agent on its own servers, citing near-unlimited data access, the risk of disrupting specialist procedures, and surveillance concerns, and demanding the Senate assume full responsibility and cost (per rbb and heise). This is what a ransomware rebuild actually looks like inside a federated public body: not one clean restore, but weeks of contested, cross-jurisdiction cleanup — which is exactly why the forensics-and-rebuild line dominates the cost estimate below.

Analysts were quick to say this is not a Berlin-only story. Germany’s Cyberintelligence-Institut called for a nationwide crash programme for municipal cyber-resilience, warning that a comparable attack could hit “nearly any” large German city because state and municipal cybersecurity remains a patchwork of hard-to-oversee responsibilities. The uncomfortable implication for any public body or supplier: the weaknesses that decided Berlin’s blast radius were knowable in advance — but only if someone had measured them.

The cost was downtime and liability — not the ransom

The €2 million demand made headlines, but it is the least relevant number. The costs that actually landed were:

• Business interruption. Two departments offline for ~10 days; 50,000 households unable to receive housing benefit for weeks; ~12,000 systems taken down for round-the-clock scanning.
• GDPR exposure. Personal data of civil servants and citizens — identity documents, HR files, financial records — now requires individual notification and carries breach liability across an entire state administration.
• Critical-infrastructure & national security. The dump reportedly included civil-defence and emergency concepts, documents on barracks, and detailed plans for critical infrastructure — water and heating plants, substations, emergency-power systems — and even construction plans for prisons. Because confidential Bundeswehr and federal-government material was affected, the Bundeswehr’s operational command, the National Cyber Defence Centre and the BSI stepped in; a senior CDU defence politician called the outflow “of grave extent” and a danger to national security. A financial crime had become a national-security incident.

(Rhysida’s own claims — e.g. exact record counts, classified material, CBRN planning documents — are the attacker’s figures and have not been independently verified. We lead with what officials and the BSI have confirmed; the categories above are drawn from mainstream reporting, and we reproduce none of the leaked data itself.)

What the damage actually adds up to

Berlin has published no cost figure — so we ran the incident through Nisura’s own CRQ engine to put a defensible euro range on it. We modelled the two affected Senate departments as a “Public administration” entity in Germany (≈3,500 staff, €41.3/hour loaded labour cost, no security controls credited — plaintext passwords were confirmed). Because the breach actually happened, the relevant figure is the single-loss cost of the event, then adjusted for two realities the generic model doesn’t capture for a public body.

Two honest adjustments sit behind that number. First, the engine’s generic NIS2 “2% of turnover” penalty (which would add €6–20M) is struck to near-zero: under §43(3) BDSG a German public authority is exempt from GDPR administrative fines, and NIS2’s German transposition relies on supervisory and remediation orders rather than penalties for public administration — so the liability is notification and civil claims, not a supervisory fine. Second, the engine caps forensics at €250k (an enterprise ceiling); a capital-city incident — state-wide credential rotation, reimaging ~12,000 systems, weeks of external DFIR, and the hardening that follows — is realistically €6–25M, anchored to Sophos’ mean recovery-ex-ransom figure scaled to a state administration. This is an independent estimate, not an official Berlin figure — every input is stated so you can adjust it and re-run the numbers yourself.

How the estimate compares to real recovery costs

An engine number is only as good as the reality you check it against — but a comparison is only honest if the incidents are actually alike. So we split the evidence in two: like-for-like cases (the same actor, Rhysida, hitting a public body that also refused the ransom, with data exfiltrated and leaked) and a broader reference class (different actors, usually encryption-lockouts rather than leaks) shown only for scale. Costs exclude the ransom, the same basis as our estimate.

Lean only on the like-for-like cases and the estimate still holds. The British Library — the same Rhysida group, a public body that also refused to pay — spent an estimated £6–7 million recovering a single national institution, about 40% of its reserves; Rhysida’s 2024 hit on the City of Columbus put one city’s recovery in the millions too. Berlin is materially larger than either: two full Senate departments, ~12,000 systems taken offline for scanning, and a 1.44-million-file leak. Scaling from a single institution at £6–7M to a two-department state administration puts €12–40 million squarely in range — and a Berlin Green MP has already warned publicly that the incident “will cost taxpayers millions.”

The reference-class cities (Atlanta, Baltimore and the German districts) point the same way — public-sector recovery routinely runs to tens of millions — but we treat them as scale, not proof: they involve different groups and were mostly encryption-lockouts rather than exfiltration-and-leak, so they are not a direct analogue for Berlin.

Figures span different years and currencies, so read them as an order-of-magnitude check, not a precise conversion. We deliberately exclude economy-wide impact figures (e.g. the ~£1.9bn attributed to the 2025 Jaguar Land Rover attack) and private-sector mega-incidents (e.g. Change Healthcare at ~$2.5bn) as non-comparable — they show the ceiling, not a public administration’s recovery bill.

Why the story isn’t over — double extortion and the follow-on wave

The publication is not the end of the incident; for the victims it is closer to the beginning. Three things now play out over months, not days:

• Double extortion means backups aren’t enough. Modern ransomware copies data before encrypting, then threatens to publish. Even a flawless restore from clean backups cannot un-leak what already left the building — which is why network segmentation and tight controls on lateral movement and data exfiltration matter as much as recovery.
• A follow-on spear-phishing wave. With real names, roles, phone numbers and internal processes now in circulation, attackers can craft highly convincing targeted messages. As German IT press has warned, a caller or email knowing a genuine internal detail is no longer proof of identity — the leak becomes ammunition for the next attack.
• Timing risk. The dump landed just before Berlin’s state election on 20 September 2026. Investigators class the attack as financially motivated, not political — but data stolen for money can later be repurposed for “hack-and-leak” influence operations.

For context on scale: Germany’s Federal Criminal Police Office (BKA) put the economic damage from cybercrime at roughly €202 billion in its 2025 situation report, with over a thousand recorded ransomware attacks. Berlin is not an anomaly — it is the pattern, at the scale of a capital city.

Why this is the risk Nisura is built to quantify

Strip away the specifics and the Berlin attack is a model of the exposure the Nisura engine prices for every organisation:

• A credential and human vector, not a CVE. Phishing → ClickFix → pasted command → plaintext passwords. Nisura models this non-CVE credential path as a first-class contributor to your annual breach likelihood, and prices the security-awareness training NIS2 Article 21 requires.
• Downtime and recovery as the real number. Nisura’s figure is an Expected Annual Loss in euros — downtime, business interruption, forensics and regulatory liability — exactly the costs Berlin actually incurred, not the ransom it refused.
• EU regulatory liability, mapped. A public body or its suppliers face NIS2 and GDPR exposure on top of the incident cost. See whether the Directive binds you with the NIS2 Scope Checker, and what compliance actually costs on the NIS2 cost calculator.

What EU public bodies and their suppliers should take from it

• Close the detection-to-containment gap. Days passed between exfiltration and isolation. Tested incident-response and network segmentation don’t change the odds of a lure landing — they change how much leaves the building afterward.
• Kill plaintext credentials and enforce MFA. The single cheapest key an attacker can hold is a password in the clear. Phishing-resistant MFA and a real secrets store remove it.
• Quantify before, not after. As the AK Oberösterreich case showed, victims often cannot even measure the blast radius afterward. Put a euro figure on your external exposure while you still can — see also our breakdown of the Arbeiterkammer attack and why Germany is Europe’s most-targeted country.

The uncomfortable through-line: none of this required a nation-state or a novel exploit. A phishing email, a fake captcha, and a plaintext password list were enough to disrupt a European capital’s administration and expose critical-infrastructure data. That chain is measurable before it happens. Run the free CRQ simulation to see your own projected annual loss in euros from exactly these vectors, or watch the live picture on the EU Ransomware Tracker.

Sources & references

• Land Berlin / Senatskanzlei — official press release on the data leak and crisis response and the follow-up on the second data package (including access credentials), and the central contact point for affected people (the public info page at berlin.de/cyberangriff).
• BSI — Cybersicherheitswarnung (BITS) and Mastodon confirmation of the TerminalFix vector.
• Microsoft Security — TerminalFix campaign analysis.
• heise online — BSI explains first attack vector on Berlin authorities and the full incident timeline (German).
• Reuters — Berlin launches crisis response after hackers publish stolen data.
• Tagesschau — FAQ on the consequences of the Berlin hack.
• Cybernews — 1.4 million stolen Berlin government files dumped on the dark web, and Security Affairs — Berlin ransomware leak exposes state secrets.
• IT-Administrator — Berlin-Hack: analysis, follow-on risk & what those affected should do; IT-Daily — Senate gives a partial all-clear on the data; CISA — #StopRansomware: Rhysida advisory (AA23-319A).
• On the systemic causes and the fragmented recovery — heise online: “Exploited a loophole: what favoured the Rhysida attack in Berlin” and “National-security risk: Berlin data leak causes major repercussions” (which reports the CrowdStrike/Lichtenberg forensics dispute, via rbb), plus the Berlin Data Protection Commissioner’s guidance for those affected.
• CTI aggregation — the Rhysida “Berlin, Germany” entry on ransomware.live (mirrors the group’s own leak-blog listing — 5.79 TB, ~1.44 million files; the attackers’ claim, labelled as such, no leaked data reproduced here).
• Recovery-cost benchmarks — the British Library cyber-incident review, the Sophos State of Ransomware 2025, IBM’s Cost of a Data Breach 2025, and reported figures for Columbus, Atlanta, Baltimore and Anhalt-Bitterfeld.

Figures attributed to Rhysida are the attackers’ claims and vary by source; confirmed facts are sourced to the Berlin Senate and the BSI. We reproduce no leaked personal data. Nisura did not scan, probe, or access any Berlin systems for this article.