Skip to the story
All stories

Berlin hackers publish stolen data after ransom refusal

Rhysida group releases 1.4 million files after city authorities decline to pay 30 bitcoins.

AI-assisted coverage comparison, editor-supervised · How this was made

Published
Visée par une cyberattaque, la mairie de Berlin refuse de payer une rançon et voit ses données publiées. Photo d’illustration.

What this story says

  • Hackers from the Rhysida group published approximately 1.4 million files stolen from Berlin's city government on the dark web.
  • The group had demanded a ransom of 30 bitcoins, valued at around €2 million, which Berlin authorities refused to pay.
  • The cyberattack reportedly began between 7 August and 12 August, with data being released on 4 September.
  • Berlin's state government announced a crisis response on 5 September to review the stolen data.

Who covered it

Left 8%(3)Centre 43%(16)Right 49%(18)

Percentages are shares of the 37 outlets carrying a published leaning rating. 4 of the 41 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .

Trust

86/100

Craft

95/100

Hype

25/100

41 sources · methodology

Thin on the left so far

Only 3 of the 37 outlets with a published leaning rating that ran this story are rated left.

This story is still being watched, so it is a count and not yet a finding. Coverage keeps arriving for hours after an event, and a side that has published nothing this morning may publish by tonight. If it is still true when we stop checking, we will say so plainly.

The hacker group Rhysida has published a large volume of data stolen from Berlin's city government on the dark web. The group had demanded a ransom of 30 bitcoins, which was valued at approximately €2 million, but Berlin authorities refused to pay. In response, the hackers released the stolen files on 4 September.

The cyberattack reportedly began between 7 August and 12 August, affecting administrations responsible for housing and environment. The full extent of the leaked data includes around 1.4 million files, amounting to approximately 5.8 terabytes. Berlin's state government announced on 5 September that it was reviewing the stolen data with the highest intensity as part of a crisis response.

Disagreement on attack timeline

Source 1 states the cyberattack began on 14 August, while Source 2 indicates it occurred between 7 August and 12 August.

What the coverage left out

None of the left-rated digests mention the specific figure of 5.8 terabytes for the leaked data, a detail present in the centre and right-rated reports. The full reports from Le Huffington Post and Deutsche Welle did not mention the specific date of 5 September when Berlin's state government announced its crisis response.

Still developing. We have re-checked which outlets are covering this 3 times, most recently on 5 Sept 2026, 19:30, and will add the sides that appear.

How other outlets pictured it

Which photograph to run is each newsroom’s own choice. The leaning beside a name is that outlet’s published rating, not a claim that the pictures divide along it. Every picture is shown from the outlet’s own server and links to the article it ran in.

Berlin hackers publish stolen data after ransom refusal
Deutsche WelleCentre
Berlin hackers publish stolen data after ransom refusal
24ur.comCentre

How each side covered it

Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.

Left

3 rated outlets

  • Left-rated reports highlighted the refusal to pay the ransom and the subsequent publication of data. Source 1, Le Huffington Post, detailed the hacker group Rhysida's previous actions, including an attack on the British Library where a ransom was also refused and data was published. This report also noted that the Office for the Protection of the Constitution indicated the attack seemed motivated by financial reasons rather than political ones, despite occurring before municipal elections.

Centre

16 rated outlets

  • Centre-rated reports focused on the scale of the data leak and the government's response. Deutsche Welle (Source 2) reported that the leaked data included information on the city's water supply vulnerability, crisis plans, personal data, and salary information, with potential catastrophic security consequences. This report also mentioned that German state authorities are legally prohibited from paying ransom demands. Several centre-rated digests, such as those from mannheim24.de, Kreiszeitung, merkur.de, hna.de, and tz.de, highlighted that experts and the opposition were appalled by the leak of critical infrastructure data and called for consequences.

Right

18 rated outlets

  • Right-rated reports primarily focused on the government's crisis response following the data publication. Digests from outlets like The Star Kuala Lumpur, WKZO, WTAQ, KELO Newstalk 1320 107.9, and WSAU, often using Reuters wording, stated that Berlin's state government was reviewing the stolen data with the highest intensity. Kurier reported that a security expert warned of numerous possibilities for abuse following the refusal to pay the €2 million ransom.

Questions about this coverage

How did the left and right cover Berlin hackers publish stolen data after ransom refusal?
Of the 37 outlets on this story carrying a published leaning rating, 8% are rated left, 43% are rated centre, 49% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 41. The sections above set out what each side emphasised, in its own terms.
Is Berlin hackers publish stolen data after ransom refusal left or right?
Neither side dominates it. Of the 37 rated outlets on this story, 8% are rated left, 43% are rated centre, 49% are rated right, and no side holds the 70% this site would want before calling a field one-sided. A story is not left or right in any case; the outlets that carried it are what carry ratings.
Is the coverage of Berlin hackers publish stolen data after ransom refusal biased?
Berlin hackers publish stolen data after ransom refusal is one event reported by 41 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
Which side is not reporting Berlin hackers publish stolen data after ransom refusal?
When we first saw this story, outlets rated left had barely covered it. Coverage accretes for hours after an event, so that is where to look rather than a verdict — the split above is the current count, and it is the one to read.
Which outlets covered Berlin hackers publish stolen data after ransom refusal?
41 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
How much data was stolen from Berlin?
Approximately 1.4 million files, amounting to about 5.8 terabytes, were stolen from Berlin's city government. The hacker group Rhysida published this data on the dark web after their ransom demand was refused.
What was the ransom demand?
The hacker group Rhysida demanded 30 bitcoins, which was valued at approximately €2 million. Berlin authorities refused to pay this ransom.
When did the cyberattack occur and when was the data published?
One report states the cyberattack began on 14 August, while another suggests it occurred between 7 August and 12 August. The hackers released the stolen data on 4 September.
What is Berlin's response to the data leak?
Berlin's state government announced a crisis response on 5 September, stating that the stolen data was being reviewed with the highest intensity. Investigators are working to assess the scale and impact of the cyberattack.

Read it at the source

41 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.

Left

3

Centre

16
Show 8 more

Right

18
Show 10 more

Not rated

4

How did this read?

About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.

Berlin hackers leak 1.4m files | MediaBias News