Berlin Rejects Extortion Demand as Forensics Find Further Data Outflows
Summary
Berlin says it will not pay extortionists after forensic work found further data outflows from a Senate department. Separately, Manchester Airports Group confirmed customer data was obtained from booking and WiFi-related systems at three airports.
Key points
- Berlin’s state government confirmed it is being extorted after an August compromise of its administrative network and said it will not pay.
- Forensic work found further data outflows from a Senate department between August 7 and 12, 2026; personal or other non-public information cannot be ruled out.
- Berlin has not stated how much data left the network. A Rhysida leak-site post claimed 5.79 terabytes; reporting and a monitoring service attributed the listing to Rhysida.
- Berlin’s departments were reconnected on August 23, and forensic work continues. Housing benefit applications and payments had been unavailable during the disruption.
- Manchester Airports Group confirmed customer data was obtained from booking and WiFi-related systems at Manchester, London Stansted and East Midlands airports. The data includes contact details, vehicle registrations and postcodes, but not bank or payment details.
- MAG said airport operations and aviation security were unaffected; its Manage My Booking service was suspended as a precaution. The company has not stated how many customers were affected.
Article Details
- Victim Organization
- Berlin state government
- Incident Type
- Compromise of the state administrative network with data exfiltration and an extortion attempt.
- Incident Date
- 2026-08-07
- Disclosure Date
- 2026-08-17
- Data Types Exposed
- Personal or other non-public data may have been exfiltrated; scope is still under examination.
- The attackers claimed the data included personal information and maps and geodata.
- Affected Records
- The attackers claimed personal information on 12,076 individuals; Berlin has not published a confirmed affected-person count.
- Affected Data Size
- The attackers claimed 5.79 terabytes and around 1.44 million files; Berlin has not confirmed these figures.
- Operational Impact
- Housing benefit applications and payments were unavailable while two departments were disconnected from the network. All Senate departments were reconnected on August 23, 2026. Berlin said no data had left areas relevant to the September 20 election, based on information available at the time.
- Ransom Or Extortion
- Berlin confirmed it was being extorted and said it would not pay. No ransom amount was reported. Rhysida's leak-site post claimed 5.79 terabytes of data, but the amount and contents were not confirmed by Berlin.
- Claim Status
- confirmed
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe advisory identifies exploitation of Zerologon for privilege escalation as a Rhysida access route; the article does not establish that it was used against Berlin.T1078 · Valid AccountsThe advisory describes actors using compromised valid accounts to access VPN entry points; the article does not establish that this occurred in the Berlin incident.T1133 · External Remote ServicesA joint advisory on Rhysida documents external-facing remote services as an initial-access route; the article does not establish that this route was used against Berlin.T1566 · PhishingThe advisory lists phishing as a successful route into victim networks; the article does not establish that phishing was used against Berlin.
CVE
People
Threat Actors
Vendors
Countries
Industries
Aviation“At no point has passenger safety or aviation security been compromised,” a MAG spokesperson said in the company’s published statement, adding that airport operations and customer parking services continue to operateGovernmentBerlin’s state government says it is being extorted after the August compromise of its state administrative network and will not pay, while forensic work also found additional data exfiltration from the Senate