Rhysida claims Berlin government data breach

28 August 2026 high threat government-nationalinfrastructure

Ransomware group Rhysida lists a Berlin, Germany government entity as a victim, claiming 5.79TB of data including PII, credentials, and classified material.

Ransomware.live tracked a listing by the Rhysida ransomware group claiming compromise of a government entity in Berlin, Germany. The claimed data trove totals 5.79TB across roughly 1.44 million files, spanning categories including geo/mapping data, legal complaints, financial records, contracts, HR files, government supervisory documents, confidential material, infrastructure data, passwords, health records, and contact lists.

Of particular concern to defenders is the reported presence of plaintext credentials for multiple systems (a building management/GebäudeAtlas system, the PAYONE ePayment database, and personal password-safe accounts), personnel and payroll data for thousands of individuals, PII including emails, phone numbers, and IBANs, and documents relating to disciplinary and legal proceedings. The listing also claims exposure of Bundesrat committee protocols, classified-material handling (Geheimschutz) data, and vulnerability analyses of Berlin's water supply — the latter representing a potential KRITIS (critical infrastructure) exposure if authentic. No independent verification of the claims' authenticity was provided in the source; ransomware leak-site postings are unverified extortion claims until corroborated by the victim or a trusted third party.

Defenders in German government and public-sector entities, particularly those with KRITIS designations or shared infrastructure with Berlin municipal/state systems, should treat this as a signal to review exposure of similar systems (payment databases, personnel records, credential stores) and monitor for potential secondary use of leaked credentials in follow-on attacks such as credential stuffing or business email compromise.

Mentioned in this report

Threat actors rhysida

Malware Rhysida

Detection guidance

Bulk Data Exfiltration to Cloud Storage Service

ATT&CK T1567.002

Detects large-volume data transfers to cloud storage endpoints (AWS S3, Azure Blob, Google Cloud Storage, etc.) indicative of exfiltration or staging for ransom leak. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Bulk Data Exfiltration to Cloud Storage Service
description: Detects network connections to cloud storage providers (S3, Azure Blob,
  GCS, Wasabi, Backblaze) on ports 443/80 involving high data transfer volume or suspicious
  tool user-agents. Generalises on cloud storage hostnames and suspicious transfer
  patterns, not campaign-specific buckets or IPs.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_cloud_storage:
    DestinationHostname|contains:
    - .s3.
    - .s3-
    - blob.core.windows.net
    - storage.googleapis.com
    - cloudflare.com
    - wasabisys.com
    - backblazeb2.com
  selection_high_volume:
    DestinationPort:
    - 443
    - 80
  filter_legitimate_sync:
    Image|endswith:
    - \OneDrive.exe
    - \Dropbox.exe
    - \GoogleDriveSync.exe
    - \SyncEngine.exe
  condition: selection_cloud_storage and selection_high_volume and not filter_legitimate_sync
falsepositives:
- Legitimate cloud backup/sync clients (OneDrive, Dropbox, Google Drive)
- Development/CI-CD pipelines uploading artifacts to S3
level: medium
id: e69f8dd7-987d-59d7-b3a3-ec8ced5b71c7
status: experimental
author: Vorant

Credential Harvesting and Exfiltration via Archive Utility

ATT&CK T1530

Detects processes creating large archive files (ZIP, RAR, 7z) containing sensitive directories (credential stores, password managers, %APPDATA%, LSASS memory dumps) for subsequent exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Harvesting and Exfiltration via Archive Utility
description: Detects command-line invocation of archival tools (WinRAR, 7-Zip, tar,
  zip) targeting credential-bearing directories or system files. Focuses on the parent/child
  process relation and distinctive argument patterns, not specific file paths or campaign
  names.
tags:
- attack.collection
- attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive_tool:
    Image|endswith:
    - \rar.exe
    - \unrar.exe
    - \7z.exe
    - \tar.exe
    - \zip.exe
  selection_sensitive_paths:
    CommandLine|contains:
    - AppData\\Roaming
    - '%APPDATA%'
    - \\Windows\\System32\\config
    - SAM
    - SYSTEM
    - ntds.dit
    - \.ssh
    - \.git\\config
    - chrome\\User Data
    - Firefox\\Profiles
  filter_admin_backup:
    User|contains: SYSTEM
  condition: selection_archive_tool and selection_sensitive_paths and not filter_admin_backup
falsepositives:
- System administrators performing legitimate backup of credential stores
- Compliance/audit tools gathering system configuration archives
level: high
id: 65d206e2-0a30-51be-afc1-6f2346117f81
status: experimental
author: Vorant

Ransomware Encryption Activity: Mass File Modification

ATT&CK T1486

Detects rapid bulk file modifications with encryption-associated extensions (.rhysida, .encrypted, .locked, etc.) or entropy spike in file write operations, characteristic of ransomware encryption routines. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: 'Ransomware Encryption Activity: Mass File Modification'
description: Detects high-frequency file creation/modification with ransomware-typical
  extensions or processes exhibiting sustained high-entropy file I/O patterns. Generalises
  on the file extension pattern and I/O velocity, not victim-specific paths.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection_encrypted_extension:
    TargetFilename|endswith:
    - .rhysida
    - .encrypted
    - .locked
    - .crypt
    - .crypted
    - .ransom
  selection_suspicious_source:
    Image|endswith:
    - \svchost.exe
    - \rundll32.exe
    - \explorer.exe
    - \chrome.exe
    CommandLine|contains:
    - -silent
    - /s
    - -encrypt
  filter_av_engines:
    Image|contains:
    - McAfee
    - Norton
    - Windows Defender
    - Kaspersky
    - Trend Micro
  condition: selection_encrypted_extension and selection_suspicious_source and not
    filter_av_engines
falsepositives:
- Transparent disk encryption tools (BitLocker, VeraCrypt) creating encrypted containers
- Enterprise DLP/encryption policies transparently protecting files
level: high
id: d9953ebb-9d0e-55d6-8fcd-d63eab2668e0
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/QmVybGluLCBHZXJtYW55QHJoeXNpZGE=

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free