Loading story…
Berlin’s public administration detected a cyberattack on its state network in mid-August after suspected data exfiltration that investigators believe occurred between 7 and 12 August. The intrusion may have begun at least a week before discovery; Berlin temporarily isolated the Senate departments responsible for transport and for construction and housing, then reconnected all Senate departments while forensic work continued. The Berlin LKA, public prosecutors, and federal security authorities are investigating the breach.
The Rhysida ransomware group has claimed responsibility and alleges it stole roughly 5.8 TB of data, demanding 30 Bitcoin—worth more than €2 million—and threatening to publish the material. The group claims the haul includes personal, personnel, financial, credential, legal, health, infrastructure, and potentially classified records affecting about 12,076 people, but Berlin has not verified the authenticity, sensitivity, or scope of the alleged data and says it will not pay. Officials said no election-related data has been identified as compromised ahead of the state-parliament election.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The Rhysida ransomware group claimed responsibility for the attack and alleged it had stolen about 5.79 TB of data, demanding 30 Bitcoin while threatening to publish the material. Berlin confirmed it faced an extortion attempt and said it would not pay; the purported stolen data and its contents had not been independently verified.
Berlin authorities learned that the incident involved an extortion attempt and potentially significant data theft. The scope, types, and sensitivity of exfiltrated data remained uncertain.
Berlin reconnected all Senate departments to the state network while forensic teams continued examining affected systems.
Berlin first publicly disclosed the cyberattack on its state-government administrative network. It isolated the Senate Department for Mobility, Transport, Climate Protection and Environment and another department following the compromise.
Berlin authorities discovered that its public-administration state network had been compromised. The affected Senate administrations for transport and for construction and housing were disconnected from the network, and the LKA and public prosecutors began investigating.
An affected Berlin Senate department internally identified an initial data outflow. Forensic investigators later assessed that data exfiltration occurred from August 7 through August 12.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcesecurityaffairs.com
Open sourceheise.de
Open sourcecyberveille.ch
Open sourceberlin.de
Open sourceheise.de
Open sourceberlin.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The British Library said personal data stolen in its 31 October cyberattack was leaked online and appeared to be offered for sale, with evidence indicating the material came from internal HR records. Images posted by the attackers appeared to show employment contracts and passport information, and the library warned that employee data had been exposed while major disruption continued across its website, online systems, reading rooms, and public Wi‑Fi. The institution urged users to change any reused passwords and said it was working with the UK National Cyber Security Centre, the Metropolitan Police, and external cybersecurity specialists. The ransomware group **Rhysida** claimed responsibility and advertised the stolen data on its leak site with a starting bid of **20 bitcoin**, in what researchers described as a **double-extortion** operation combining system encryption with data theft. US agencies including the FBI and CISA had recently warned that Rhysida has targeted organizations across education, manufacturing, IT, and government, while private-sector researchers linked the group to attacks in Europe, the Middle East, and the Americas and assessed it may be a rebrand of the older **Vice Society** operation. Analysts said Rhysida commonly gains access through phishing or compromised VPN accounts and uses ransom notes titled `CriticalBreachDetected`.
Jun 29, 2026
The British Library suffered a major ransomware attack attributed to **Rhysida** that knocked out its website, online catalogue, digital collections, email, phone network, public Wi‑Fi, and parts of its onsite operations in London and Yorkshire. The disruption forced staff to fall back on limited manual processes for reader services, item ordering, and payments, while the library kept its sites open with reduced functionality. The library said it worked with the UK **National Cyber Security Centre**, law enforcement, private forensic specialists, and the Metropolitan Police as it investigated and contained the incident. Rhysida claimed responsibility, leaked internal HR documents, and attempted to auction stolen data for **20 bitcoin** before publishing about **573GB** of files, including data reportedly taken from CRM systems. The library later said stolen information included personal data such as names, email addresses, and in some cases postal addresses and phone numbers, though not apparently financial data. Recovery took months: by mid-January the library had begun restoring its online catalogue, but warned that broader remediation could take many more months and carry multimillion-pound costs. The outage also disrupted the UK **Public Lending Right** scheme, delaying royalty payments to more than 20,000 authors and other contributors.
Jun 29, 2026
The **Rhysida** ransomware operation has intensified its focus on healthcare, with reporting and government guidance describing an expanding threat that has hit organizations across Western Europe, the Americas, and Australia. U.S. health-sector alerts and vendor research say the group has targeted education, government, manufacturing, technology, managed service providers, and increasingly **healthcare and public health** entities. Researchers have also linked Rhysida to tactics associated with the defunct **Vice Society** operation, while earlier incidents included the leak of stolen documents from the Chilean Army and suspected involvement in disruptive attacks on medical providers. Security reporting says Rhysida commonly gains initial access through **phishing** and then uses tools such as **Cobalt Strike** and **PowerShell** to disable defenses, delete shadow copies, alter RDP settings, and deploy ransomware. In a newly reported healthcare case, **SIA Medical Centre** was listed as a victim, with the attackers claiming theft of roughly **20,000 patient medical records** along with staff identity documents, plaintext credentials, HR files, and legal and financial records. The allegedly exposed data included names, dates of birth, Medicare numbers, clinical notes, insurance files, passports, driver’s licenses, and login credentials, underscoring the group’s dual risk of operational disruption and large-scale sensitive data exposure in the health sector.
Aug 15, 2026