Berlin hackers publish stolen data after ransom refusal
Rhysida group releases 1.4 million files after city authorities decline to pay 30 bitcoins.
AI-assisted coverage comparison, editor-supervised · How this was made

Visée par une cyberattaque, la mairie de Berlin refuse de payer une rançon et voit ses données publiées. Photo d’illustration.
Photograph: Le Huffington Post (embedded from source)
What this story says
- Hackers from the Rhysida group published approximately 1.4 million files stolen from Berlin's city government on the dark web.
- The group had demanded a ransom of 30 bitcoins, valued at around €2 million, which Berlin authorities refused to pay.
- The cyberattack reportedly began between 7 August and 12 August, with data being released on 4 September.
- Berlin's state government announced a crisis response on 5 September to review the stolen data.
Who covered it
Percentages are shares of the 37 outlets carrying a published leaning rating. 4 of the 41 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .
Trust
86/100
Craft
95/100
Hype
25/100
41 sources · methodology
Thin on the left so far
Only 3 of the 37 outlets with a published leaning rating that ran this story are rated left.
This story is still being watched, so it is a count and not yet a finding. Coverage keeps arriving for hours after an event, and a side that has published nothing this morning may publish by tonight. If it is still true when we stop checking, we will say so plainly.
The hacker group Rhysida has published a large volume of data stolen from Berlin's city government on the dark web. The group had demanded a ransom of 30 bitcoins, which was valued at approximately €2 million, but Berlin authorities refused to pay. In response, the hackers released the stolen files on 4 September.
The cyberattack reportedly began between 7 August and 12 August, affecting administrations responsible for housing and environment. The full extent of the leaked data includes around 1.4 million files, amounting to approximately 5.8 terabytes. Berlin's state government announced on 5 September that it was reviewing the stolen data with the highest intensity as part of a crisis response.
Disagreement on attack timeline
Source 1 states the cyberattack began on 14 August, while Source 2 indicates it occurred between 7 August and 12 August.
What the coverage left out
None of the left-rated digests mention the specific figure of 5.8 terabytes for the leaked data, a detail present in the centre and right-rated reports. The full reports from Le Huffington Post and Deutsche Welle did not mention the specific date of 5 September when Berlin's state government announced its crisis response.
Still developing. We have re-checked which outlets are covering this 3 times, most recently on 5 Sept 2026, 19:30, and will add the sides that appear.
How other outlets pictured it
Which photograph to run is each newsroom’s own choice. The leaning beside a name is that outlet’s published rating, not a claim that the pictures divide along it. Every picture is shown from the outlet’s own server and links to the article it ran in.

Berlin hackers publish stolen data after ransom refusal
Deutsche Welle — embedded from source

Berlin hackers publish stolen data after ransom refusal
24ur.com — embedded from source
How each side covered it
Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.
Left
3 rated outlets
- Left-rated reports highlighted the refusal to pay the ransom and the subsequent publication of data. Source 1, Le Huffington Post, detailed the hacker group Rhysida's previous actions, including an attack on the British Library where a ransom was also refused and data was published. This report also noted that the Office for the Protection of the Constitution indicated the attack seemed motivated by financial reasons rather than political ones, despite occurring before municipal elections.
Centre
16 rated outlets
- Centre-rated reports focused on the scale of the data leak and the government's response. Deutsche Welle (Source 2) reported that the leaked data included information on the city's water supply vulnerability, crisis plans, personal data, and salary information, with potential catastrophic security consequences. This report also mentioned that German state authorities are legally prohibited from paying ransom demands. Several centre-rated digests, such as those from mannheim24.de, Kreiszeitung, merkur.de, hna.de, and tz.de, highlighted that experts and the opposition were appalled by the leak of critical infrastructure data and called for consequences.
Right
18 rated outlets
- Right-rated reports primarily focused on the government's crisis response following the data publication. Digests from outlets like The Star Kuala Lumpur, WKZO, WTAQ, KELO Newstalk 1320 107.9, and WSAU, often using Reuters wording, stated that Berlin's state government was reviewing the stolen data with the highest intensity. Kurier reported that a security expert warned of numerous possibilities for abuse following the refusal to pay the €2 million ransom.
Questions about this coverage
- How did the left and right cover Berlin hackers publish stolen data after ransom refusal?
- Of the 37 outlets on this story carrying a published leaning rating, 8% are rated left, 43% are rated centre, 49% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 41. The sections above set out what each side emphasised, in its own terms.
- Is Berlin hackers publish stolen data after ransom refusal left or right?
- Neither side dominates it. Of the 37 rated outlets on this story, 8% are rated left, 43% are rated centre, 49% are rated right, and no side holds the 70% this site would want before calling a field one-sided. A story is not left or right in any case; the outlets that carried it are what carry ratings.
- Is the coverage of Berlin hackers publish stolen data after ransom refusal biased?
- Berlin hackers publish stolen data after ransom refusal is one event reported by 41 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
- Which side is not reporting Berlin hackers publish stolen data after ransom refusal?
- When we first saw this story, outlets rated left had barely covered it. Coverage accretes for hours after an event, so that is where to look rather than a verdict — the split above is the current count, and it is the one to read.
- Which outlets covered Berlin hackers publish stolen data after ransom refusal?
- 41 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
- How much data was stolen from Berlin?
- Approximately 1.4 million files, amounting to about 5.8 terabytes, were stolen from Berlin's city government. The hacker group Rhysida published this data on the dark web after their ransom demand was refused.
- What was the ransom demand?
- The hacker group Rhysida demanded 30 bitcoins, which was valued at approximately €2 million. Berlin authorities refused to pay this ransom.
- When did the cyberattack occur and when was the data published?
- One report states the cyberattack began on 14 August, while another suggests it occurred between 7 August and 12 August. The hackers released the stolen data on 4 September.
- What is Berlin's response to the data leak?
- Berlin's state government announced a crisis response on 5 September, stating that the stolen data was being reviewed with the highest intensity. Investigators are working to assess the scale and impact of the cyberattack.
Read it at the source
41 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.
Left
3- Berlin City Hall Stands up to Its hackers... Who End up Publishing Stolen Data. (opens Le Huffington Post in a new tab)
Le Huffington Post — is Le Huffington Post biased? Our profile of this outlet
- Hackers Released Six Million Terabytes of Important Berlin Government Data (opens detector.media in a new tab)
detector.media — is detector.media biased? Our profile of this outlet
- Hackers publish stolen data from Berlin government After refusal to pay ransom (opens SANA in a new tab)
Centre
16- Berlin launches crisis response after hackers publish stolen data (opens Reuters in a new tab)
- Berlin launches crisis response after hackers publish stolen data (opens WTVB in a new tab)
- Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences (opens mannheim24.de in a new tab)
mannheim24.de — is mannheim24.de biased? Our profile of this outlet
- Berlin launches crisis response after hackers publish stolen data (opens Market Screener in a new tab)
Market Screener — is Market Screener biased? Our profile of this outlet
- Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences (opens Kreiszeitung in a new tab)
Kreiszeitung — is Kreiszeitung biased? Our profile of this outlet
- Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences (opens merkur.de in a new tab)
- Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences (opens hna.de in a new tab)
- Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences (opens tz.de in a new tab)
Show 8 more
- Sensitive Berlin Data on the Network: What Dangers Are Now at Stake? (opens wz.de in a new tab)
- Cybercrime - After Failed Blackmail: Hackers Publish Citizens' Private Data in Darknet (opens Deutschlandfunk in a new tab)
Deutschlandfunk — is Deutschlandfunk biased? Our profile of this outlet
- The Hackers Posted the Secret Documents of the Berlin Senate on the Darknet. (opens Deutsche Welle in a new tab)
Deutsche Welle — is Deutsche Welle biased? Our profile of this outlet
- After Hacker Attack: IT Expert Accuses Berlin of "Great Negligence" (opens saarbruecker-zeitung.de in a new tab)
saarbruecker-zeitung.de — is saarbruecker-zeitung.de biased? Our profile of this outlet
- Hacker Attack on Berlin: They Didn't Pay, so 1.4 Million Files Were Exposed (opens 24ur.com in a new tab)
- Data Theft in Berlin: Blackmailers Publish Sensitive Data – BSI Warns of Increased Cyber Threat (opens INTELLINEWS in a new tab)
INTELLINEWS — is INTELLINEWS biased? Our profile of this outlet
- Hackers Leak Data From Berliner Landesnetz - BSI Alerts (opens Tagesschau in a new tab)
Tagesschau — is Tagesschau biased? Our profile of this outlet
- "This Testifies to a Certain Helplessness: Harsh Criticism of the Senate's Handling of the Hacker Attack (opens Der Tagesspiegel in a new tab)
Der Tagesspiegel — is Der Tagesspiegel biased? Our profile of this outletOpinion
Right
18- Berlin launches crisis response after hackers publish stolen data - Regional Media News (opens regionalmedianews.com in a new tab)
regionalmedianews.com — is regionalmedianews.com biased? Our profile of this outlet
- Berlin launches crisis response after hackers publish stolen data (opens The Star Kuala Lumpur in a new tab)
The Star Kuala Lumpur — is The Star Kuala Lumpur biased? Our profile of this outlet
- Berlin Adopts Crisis Response After Hackers Publish Stolen Data (opens Globo in a new tab)
- Berlin launches crisis response after hackers publish stolen data (opens The Straits Times in a new tab)
The Straits Times — is The Straits Times biased? Our profile of this outlet
- Berlin launches crisis response after hackers publish stolen data (opens WSAU in a new tab)
- Berlin launches crisis response after hackers publish stolen data (opens KELO Newstalk 1320 107.9 in a new tab)
KELO Newstalk 1320 107.9 — is KELO Newstalk 1320 107.9 biased? Our profile of this outlet
- Berlin launches crisis response after hackers publish stolen data (opens WTAQ in a new tab)
- Berlin launches crisis response after hackers publish stolen data (opens WKZO in a new tab)
Show 10 more
- The Rhysida hackers have posted nearly 1.44 million files, stolen from the Berlin authorities, on the dark web (opens news-pravda.com in a new tab)
news-pravda.com — is news-pravda.com biased? Our profile of this outlet
- "Have Fun, Data Hunters: After Hacker Attack on Berlin Sensitive Data in the Darknet (opens Kurier in a new tab)
- Wegner's Berlin IT-GAU: Secret Plans, CRITIS Data and Passwords in the Darknet (opens Report24 in a new tab)
- Hacker Attack on the Land of Berlin: Data Leak Becomes a Massive Security Risk (opens Apollo News in a new tab)
Apollo News — is Apollo News biased? Our profile of this outlet
- Berlin: The Dimension of Data Leaks Beyond Imagination (opens Bild in a new tab)
- After Data Leak: Federal Security Office Warns Against Higher Cyber Threat (opens Handelsblatt in a new tab)
Handelsblatt — is Handelsblatt biased? Our profile of this outlet
- Hacker Attack in Berlin: "The Absolute Full Disaster Has Occurred" – Highly Sensitive Data Already Everywhere in the Darknet (opens Welt in a new tab)
- The Hackers Published Five Terabytes of Berlin Authorities' Data. (opens Korrespondent.net in a new tab)
Korrespondent.net — is Korrespondent.net biased? Our profile of this outlet
- BSI Warns Against Increased Cyber Threat After Data Leak (opens focus.de in a new tab)
- Hackers Publish Sensitive Data From Berlin – BSI Warns (opens Frankfurter Allgemeine in a new tab)
Frankfurter Allgemeine — is Frankfurter Allgemeine biased? Our profile of this outlet
Not rated
4- Sensitive Berlin Data on the Network: What Dangers Are Now at Stake? (opens mainwelle.de in a new tab)
mainwelle.de — is mainwelle.de biased? Our profile of this outlet
- Sensitive Berlin Data on the Network: What Dangers Are Now at Stake? (opens bbv-net.de in a new tab)
bbv-net.de — is bbv-net.de biased? Our profile of this outlet
- Sensitive Berlin Data on the Network: What Dangers Are Now at Stake? (opens onetz.de in a new tab)
- Sensitive Berlin Data on the Network: What Dangers Are Now at Stake? (opens nordbayern.de in a new tab)
nordbayern.de — is nordbayern.de biased? Our profile of this outlet
How did this read?
About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.


