Berlin confirms second Rhysida data dump overnight
A 6 September 2026 Land Berlin press release says attackers published a further data package overnight, including access credentials. The Senate department for urban development, building and housing tightened controls that may briefly disrupt specialist procedures. Berlin has not published a full inventory of either dump.
Berlin's state press office said attackers published a second data package overnight after the cyberattack on Landesnetz Berlin. The press release dated 6 September 2026 from the Presse- und Informationsamt des Landes Berlin says the drop landed Saturday night into Sunday. The city has not published a complete public inventory of either dump.
The new package includes access credentials (Zugangsdaten) among other material, the line most first-dump headlines skipped. On Sunday the Senatsverwaltung für Stadtentwicklung, Bauen und Wohnen reviewed the measures already taken after the first publication and tightened some of them. Those extra controls may cause short-term restrictions on specialist procedures (Fachverfahren), and users are being informed.
The first publication was around 4 September, after Berlin refused to pay. BleepingComputer reported that Rhysida claimed about 5.79 TB, or about 1.44 million files, from the administrative network, and that Mayor Kai Wegner said the city would not pay. Secondary coverage put the auction floor around 30 bitcoin. Those size and ransom figures remain the attackers' claims. Berlin has not confirmed them.
A second dump that includes credentials is the same class of data-leak incident as the Aesto Health notice covering 9.5 million records.
Some offers on this page may be paid placements or contain affiliate links.
Cyberpresso: daily cyber & AI brief
Free daily newsletter, read in 5 minutes.
Subscribe free