---
title: "Berlin hackers publish stolen data after ransom refusal"
publication: "MediaBias News"
url: "https://mediabias.news/conflict/berlin-hackers-publish-stolen-data-after-ransom-refusal"
api: "https://mediabias.news/api/v1/stories/berlin-hackers-publish-stolen-data-after-ransom-refusal"
markdown: "https://mediabias.news/conflict/berlin-hackers-publish-stolen-data-after-ransom-refusal.md"
audio: "https://mediabias.news/api/audio/berlin-hackers-publish-stolen-data-after-ransom-refusal"
category: "Conflict & Security"
area: "European Union"
published: "2026-09-05T18:46:02.751Z"
source_reported: "2026-09-05T17:59:03.000Z"
updated: "2026-09-05T18:46:02.751Z"
trust_score: 86
critic_score: 95
hype_score: 25
assessment_type: "coverage-and-source-reporting-analysis"
fact_check_status: "not-performed"
coverage_measured: "2026-09-05T19:45:21.092846+00:00"
---

# Berlin hackers publish stolen data after ransom refusal

*Rhysida group releases 1.4 million files after city authorities decline to pay 30 bitcoins.*

**Scores for the source reporting** (0-100, assessing the original journalism this article was written from, not this write-up): 

- Trust 86 of 100, higher is better. Multiple named sources, figures, dates, and official statements across independent reports raise trust to 86.
- Craft 95 of 100, higher is better. Clear why it matters, quotes experts, specific data, next steps, and coherent narrative give 95.
- Hype 25 of 100, lower is better. Headlines are dramatic but body remains factual, resulting in mild emphasis score 25.

Scored by MediaBias News; method at https://mediabias.news/methodology.

**The short version**

- Hackers from the Rhysida group published approximately 1.4 million files stolen from Berlin's city government on the dark web.
- The group had demanded a ransom of 30 bitcoins, valued at around €2 million, which Berlin authorities refused to pay.
- The cyberattack reportedly began between 7 August and 12 August, with data being released on 4 September.
- Berlin's state government announced a crisis response on 5 September to review the stolen data.

The hacker group Rhysida has published a large volume of data stolen from Berlin's city government on the dark web. The group had demanded a ransom of 30 bitcoins, which was valued at approximately €2 million, but Berlin authorities refused to pay. In response, the hackers released the stolen files on 4 September.

The cyberattack reportedly began between 7 August and 12 August, affecting administrations responsible for housing and environment. The full extent of the leaked data includes around 1.4 million files, amounting to approximately 5.8 terabytes. Berlin's state government announced on 5 September that it was reviewing the stolen data with the highest intensity as part of a crisis response.

## Disagreement on attack timeline

Source 1 states the cyberattack began on 14 August, while Source 2 indicates it occurred between 7 August and 12 August.

## What the coverage left out

None of the left-rated digests mention the specific figure of 5.8 terabytes for the leaked data, a detail present in the centre and right-rated reports. The full reports from Le Huffington Post and Deutsche Welle did not mention the specific date of 5 September when Berlin's state government announced its crisis response.

## Who covered it

Shares of the 39 covering outlets with a published leaning rating:

- Left: 10% (4)
- Centre: 44% (17)
- Right: 46% (18)

4 of 43 covering outlets carried no usable leaning rating and were excluded from those percentages. Coverage measured 2026-09-05T19:45:21.092846+00:00.

**Coverage watch:** developing. Checked 7 times; 0 checks found a material change. Most recently checked 2026-09-05T20:30:13.402Z.

## How the sides framed it

### Left

- Left-rated reports highlighted the refusal to pay the ransom and the subsequent publication of data. Source 1, Le Huffington Post, detailed the hacker group Rhysida's previous actions, including an attack on the British Library where a ransom was also refused and data was published. This report also noted that the Office for the Protection of the Constitution indicated the attack seemed motivated by financial reasons rather than political ones, despite occurring before municipal elections.

### Centre

- Centre-rated reports focused on the scale of the data leak and the government's response. Deutsche Welle (Source 2) reported that the leaked data included information on the city's water supply vulnerability, crisis plans, personal data, and salary information, with potential catastrophic security consequences. This report also mentioned that German state authorities are legally prohibited from paying ransom demands. Several centre-rated digests, such as those from mannheim24.de, Kreiszeitung, merkur.de, hna.de, and tz.de, highlighted that experts and the opposition were appalled by the leak of critical infrastructure data and called for consequences.

### Right

- Right-rated reports primarily focused on the government's crisis response following the data publication. Digests from outlets like The Star Kuala Lumpur, WKZO, WTAQ, KELO Newstalk 1320 107.9, and WSAU, often using Reuters wording, stated that Berlin's state government was reviewing the stolen data with the highest intensity. Kurier reported that a security expert warned of numerous possibilities for abuse following the refusal to pay the €2 million ransom.

**Provisional coverage gap:** left. The watch is not closed, so this is not yet a settled blindspot finding.

## Factuality profile of the covering outlets

These are published factuality ratings of the outlets, not a verdict on whether this story or its claims are true.

- veryLow: 2
- mixed: 8
- high: 20
- unknown: 6
- veryHigh: 7

## Verification scope

This page compares coverage and scores the source reporting. It is not a ClaimReview verdict on whether the underlying event or claim is true.

## Original reporting this was written from

- [Hot News](https://hotnews.ro/criza-la-berlin-dupa-un-atac-cibernetic-hackerii-au-publicat-datele-dupa-ce-au-cerut-o-rascumparare-peste-2-milioane-de-euro-2342148) — Crisis in Berlin After a Cyber Attack. Hackers Published the Data, After Asking for a Ransom of More than 2 Million Euros - HotNews.ro
- [Digi 24](https://digi24.ro/stiri/externe/germania-atac-cibernetic-la-berlin-primarul-recunoaste-ca-au-fost-furate-date-sensibile-3936355) — Germany: Cyber Attack in Berlin. Mayor Admits Sensitive Data Has Been Stolen
- [regionalmedianews.com](https://regionalmedianews.com/world/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data - Regional Media News
- [The Star Kuala Lumpur](https://thestar.com.my/news/world/2026/09/06/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [Globo](https://valor.globo.com/mundo/noticia/2026/09/05/berlim-adota-resposta-de-crise-aps-hackers-publicarem-dados-roubados.ghtml) — Berlin Adopts Crisis Response After Hackers Publish Stolen Data
- [The Straits Times](https://straitstimes.com/world/europe/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [Reuters](https://reuters.com/world/berlin-launches-crisis-response-after-hackers-publish-stolen-data-2026-09-05) — Berlin launches crisis response after hackers publish stolen data
- [WTVB](https://wtvbam.com/2026/09/05/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [WKZO](https://wkzo.com/2026/09/05/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [WTAQ](https://wtaq.com/2026/09/05/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [KELO Newstalk 1320 107.9](https://kelo.com/2026/09/05/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [WSAU](https://wsau.com/2026/09/05/berlin-launches-crisis-response-after-hackers-publish-stolen-data) — Berlin launches crisis response after hackers publish stolen data
- [mannheim24.de](https://mannheim24.de/politik-wirtschaft/hacker-debakel-in-berlin-kritische-infrastruktur-daten-geleakt-opposition-fordert-konsequenzen-zr-94476722.html) — Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences
- [Market Screener](https://marketscreener.com/news/berlin-launches-crisis-response-after-hackers-publish-stolen-data-ce785bdbda8cfe25) — Berlin launches crisis response after hackers publish stolen data
- [Kreiszeitung](https://kreiszeitung.de/politik/hacker-debakel-in-berlin-kritische-infrastruktur-daten-geleakt-opposition-fordert-konsequenzen-zr-94476722.html) — Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences
- [merkur.de](https://merkur.de/politik/hacker-debakel-in-berlin-kritische-infrastruktur-daten-geleakt-opposition-fordert-konsequenzen-zr-94476722.html) — Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences
- [hna.de](https://hna.de/politik/hacker-debakel-in-berlin-kritische-infrastruktur-daten-geleakt-opposition-fordert-konsequenzen-zr-94476722.html) — Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences
- [tz.de](https://tz.de/politik/hacker-debakel-in-berlin-kritische-infrastruktur-daten-geleakt-opposition-fordert-konsequenzen-zr-94476722.html) — Hacker Debacle in Berlin: Critical Infrastructure Data Leaked – Opposition Calls for Consequences
- [news-pravda.com](https://news-pravda.com/eu/2026/09/05/2568876.html) — The Rhysida hackers have posted nearly 1.44 million files, stolen from the Berlin authorities, on the dark web
- [Kurier](https://kurier.at/politik/ausland/hackerangriff-berlin-sensible-daten-darknet/403188933) — "Have Fun, Data Hunters: After Hacker Attack on Berlin Sensitive Data in the Darknet
- [mainwelle.de](https://mainwelle.de/sensible-berliner-daten-im-netz-welche-gefahren-drohen-nun-2416122) — Sensitive Berlin Data on the Network: What Dangers Are Now at Stake?
- [Le Huffington Post](https://huffingtonpost.fr/international/article/la-mairie-de-berlin-tient-tete-a-ses-hackers-qui-finissent-par-publier-ses-donnees-volees-lors-d-une-cyberattaque_318782.html) — Berlin City Hall Stands up to Its hackers... Who End up Publishing Stolen Data.
- [bbv-net.de](https://bbv-net.de/dpa-infoline-zvr/sensible-berliner-daten-im-netz-welche-gefahren-drohen-nun-w1244077-6000620490) — Sensitive Berlin Data on the Network: What Dangers Are Now at Stake?
- [onetz.de](https://onetz.de/deutschland-welt/sensible-berliner-daten-netz-welche-gefahren-drohen-id5491399.html) — Sensitive Berlin Data on the Network: What Dangers Are Now at Stake?
- [nordbayern.de](https://nordbayern.de/schlagzeilen/sensible-berliner-daten-im-netz-welche-gefahren-drohen-nun-1.15266852) — Sensitive Berlin Data on the Network: What Dangers Are Now at Stake?
- [wz.de](https://wz.de/politik/inland/sensible-berliner-daten-im-netz-welche-gefahren-drohen-nun_aid-154312079) — Sensitive Berlin Data on the Network: What Dangers Are Now at Stake?
- [detector.media](https://ms.detector.media/kiberbezpeka/post/39502/2026-09-05-khakery-opublikuvaly-shist-milyoniv-terabaytiv-vazhlyvykh-danykh-uryadu-berlinu) — Hackers Released Six Million Terabytes of Important Berlin Government Data
- [Deutschlandfunk](https://deutschlandfunk.de/nach-gescheiterter-erpressung-hacker-veroeffentlichen-private-daten-von-buergern-im-darknet-100.html) — Cybercrime - After Failed Blackmail: Hackers Publish Citizens' Private Data in Darknet
- [Deutsche Welle](https://dw.com/ru/hakery-vylozili-v-darknet-konfidencialnye-dokumenty-senata-berlina/a-79045471) — The Hackers Posted the Secret Documents of the Berlin Senate on the Darknet.
- [saarbruecker-zeitung.de](https://saarbruecker-zeitung.de/nachrichten/politik/inland/it-experte-wirft-berlin-grobe-fahrlaessigkeit-vor_aid-154309623) — After Hacker Attack: IT Expert Accuses Berlin of "Great Negligence"
- [Report24](https://report24.news/wegners-berliner-it-gau-geheimplaene-kritis-daten-und-passwoerter-im-darknet) — Wegner's Berlin IT-GAU: Secret Plans, CRITIS Data and Passwords in the Darknet
- [24ur.com](https://24ur.com/novice/tujina/hekerski-napad-na-berlin-razkrili-14-milijona-datotek-tudi-obcutljive-podatke.html) — Hacker Attack on Berlin: They Didn't Pay, so 1.4 Million Files Were Exposed
- [INTELLINEWS](https://intelli.news/2026/09/05/datenklau-in-berlin-erpresser-veroffentlichen-sensible-daten-bsi-warnt-vor-erhorter-cyber-bedrohung) — Data Theft in Berlin: Blackmailers Publish Sensitive Data – BSI Warns of Increased Cyber Threat
- [Tagesschau](https://tagesschau.de/inland/bsi-hackerangriff-berlin-verwaltung-100.html) — Hackers Leak Data From Berliner Landesnetz - BSI Alerts
- [SANA](https://sana.sy/en/miscellaneous/2340574) — Hackers publish stolen data from Berlin government After refusal to pay ransom
- [Apollo News](https://apollo-news.net/hackerangriff-auf-das-land-berlin-datenleck-wird-zum-massiven-sicherheitsrisiko) — Hacker Attack on the Land of Berlin: Data Leak Becomes a Massive Security Risk
- [Bild](https://bild.de/news/inland/berlin-die-dimension-des-daten-leaks-sprengt-vorstellungskraft-6a9ba919240b302c8a839e33) — Berlin: The Dimension of Data Leaks Beyond Imagination
- [Handelsblatt](https://handelsblatt.com/politik/deutschland/nach-daten-leak-bundessicherheitsamt-warnt-vor-hoeherer-cyber-bedrohung/100252244.html) — After Data Leak: Federal Security Office Warns Against Higher Cyber Threat
- [Welt](https://welt.de/wirtschaft/video6a9bc25bfd8102779ee49b83/hackerangriff-in-berlin-die-absolute-vollkatastrophe-ist-eingetreten-hochsensible-daten-schon-ueberall-im-darknet.html) — Hacker Attack in Berlin: "The Absolute Full Disaster Has Occurred" – Highly Sensitive Data Already Everywhere in the Darknet
- [Korrespondent.net](https://korrespondent.net/world/4909216-khakery-opublykovaly-piat-terabait-dannykh-vlastei-berlyna) — The Hackers Published Five Terabytes of Berlin Authorities' Data.
- [focus.de](https://focus.de/digital/bsi-warnt-nach-daten-leak-vor-erhoehter-cyber-bedrohung_02f761ea-93b0-4de0-8aac-88963777a08f.html) — BSI Warns Against Increased Cyber Threat After Data Leak
- [Der Tagesspiegel](https://tagesspiegel.de/berlin/das-zeugt-schon-von-einer-gewissen-hilflosigkeit-harsche-kritik-am-umgang-des-senats-mit-dem-hackerangriff-16020281.html) — "This Testifies to a Certain Helplessness: Harsh Criticism of the Senate's Handling of the Hacker Attack
- [Frankfurter Allgemeine](https://faz.net/aktuell/politik/inland/hacker-veroeffentlichen-sensible-daten-aus-berlin-bsi-warnt-201196182.html) — Hackers Publish Sensitive Data From Berlin – BSI Warns

## Questions

**How much data was stolen from Berlin?**

Approximately 1.4 million files, amounting to about 5.8 terabytes, were stolen from Berlin's city government. The hacker group Rhysida published this data on the dark web after their ransom demand was refused.

**What was the ransom demand?**

The hacker group Rhysida demanded 30 bitcoins, which was valued at approximately €2 million. Berlin authorities refused to pay this ransom.

**When did the cyberattack occur and when was the data published?**

One report states the cyberattack began on 14 August, while another suggests it occurred between 7 August and 12 August. The hackers released the stolen data on 4 September.

**What is Berlin's response to the data leak?**

Berlin's state government announced a crisis response on 5 September, stating that the stolen data was being reviewed with the highest intensity. Investigators are working to assess the scale and impact of the cyberattack.

---

MediaBias News — https://mediabias.news. Reproduced from https://mediabias.news/conflict/berlin-hackers-publish-stolen-data-after-ransom-refusal. Please cite as: MediaBias News, "Berlin hackers publish stolen data after ransom refusal", https://mediabias.news/conflict/berlin-hackers-publish-stolen-data-after-ransom-refusal