The incident implicates the city’s internal networks, and authorities are currently coordinating with federal cybersecurity agencies to assess the scope of the breach. While the full extent of the stolen information has not been publicly detailed, the confirmation underscores the seriousness of the attack, which targeted a major European capital’s administrative infrastructure.

• The Rhysida ransomware group has claimed responsibility for the intrusion and data leak.
• Berlin’s administration has verified that cybercriminals stole data and are now attempting to extort the city.
• Federal authorities are involved in the ongoing investigation and response.

This development serves as a stark reminder that public-sector organizations remain high-value targets for ransomware groups, often facing dual pressure from operational disruption and the threat of sensitive data exposure. The city has not indicated whether any ransom demands have been met, and no specific technical indicators or remediation steps have been released to the public at this time.

Source: BleepingComputer

Is your organization actively monitoring for Rhysida-related indicators, and have you tested your incident response plan against data-exfiltration scenarios like this one?