Breaches and incidentsBriefChecked against a primary source
Berlin state administration (two Senate departments): large volumes of files copied
Berlin’s data protection authority says attackers were active between 7 and 12 Aug 2026 in the networks of the Senate departments for Urban Development...
- Disclosed
What happened
- Berlin’s data protection authority says attackers were active between 7 and 12 Aug 2026 in the networks of the Senate departments for Urban Development, Building and Housing and for Mobility, Transport, Climate Protection and Environment, copying mostly unstructured files from shared and personal directories: names, addresses, dates of birth, correspondence and, depending on contact, bank details and copies of submitted documents of citizens, companies and employees.
- Root cause / initial access: not disclosed.
- Attacker: the Rhysida ransomware group claimed responsibility (Konbriefing, CM Alliance); the authority’s page does not name the attacker and has not confirmed what was published.
- Response: systems disconnected, state crisis response, contact points and citizen guidance; scope still under review as of 11 Sep.
Sources
- https://www.datenschutz-berlin.de/datenschutz/hinweise-zum-hackerangriff-auf-berlin/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.