FlagThis — Daily Cybersecurity Intelligence Briefing

The Rhysida ransomware group has compromised the administrative network of the Berlin city-state government, exfiltrating approximately 5.79 TB of sensitive data. The attack utilizes a double-extortion model, where the threat actor threatens to leak or sell the stolen data to maximize leverage. This breach was strategically timed to coincide with local elections, increasing the political pressure on municipal authorities. Despite the significant scale of data loss and the specific targeting of government infrastructure, Berlin officials have officially maintained a non-payment policy regarding ransom demands, prioritizing long-term security posture over immediate mitigation via extortion.