Berlin Senate Declares End of IT Emergency Six Weeks After Russian-Linked Rhysida Cyberattack

Published October 15, 2026, Tagesspiegel reported that Berlin's State Secretary for Digitalization Florian Hauer (CDU) declared an end to the acute emergency phase following a major cyberattack in August 2026. The Russian-linked hacker group 'Rhysida' breached two Berlin Senate administrations, exfiltrating 1.4 million files totalling 4 terabytes of data. The attackers demanded 30 bitcoins (approximately €2 million) in ransom, which the Senate refused; the stolen data was subsequently published on the dark web in early September. The attack exposed personal data of at least approximately 10,000 individuals, with total minimum costs estimated at €4 million, plus six-figure contracts with Deutsche Telekom and US security firm CrowdStrike. The Senate implemented a 'Managed Detection and Response' service operating 24 hours a day, seven days a week. Hauer described the new system as a security alarm that immediately alerts a response team. Artificial intelligence is being deployed to analyse compromised data and identify additional affected individuals. The investigation into the attackers continues, with log-file traces reportedly obscured.