Berlin's 6TB leak: what Rhysida's government dump means for public sector security

Berlin's state government entered crisis mode in early September after the Rhysida ransomware group dumped what researchers describe as roughly six terabytes of stolen data. The ransom deadline passed around September 4. Payment did not happen. The leak followed.

The timeline in plain terms

Reuters reported that Berlin launched an emergency response on September 5 after data taken from two government departments appeared online. Security Affairs and regional threat-intelligence outlets attributed the attack to Rhysida, a group that has hit hospitals, municipalities, and universities across Europe and North America with double-extortion tactics.

Reporting described a demand near 30 bitcoin, roughly two million euros at the time, with publication after the government declined. The scale matters as much as the dollars. Six terabytes is not a folder of scanned PDFs. It is years of operational material, correspondence, and according to some accounts, content touching national defense themes held in state systems.

Why Rhysida keeps showing up

Rhysida runs a familiar playbook: get in, exfiltrate, encrypt where profitable, name a price, publish if ignored. They list victims on a leak site and rotate between opportunistic access and targeted public-sector hits. For Berlin the reputational damage is front page. For smaller agencies the same group is a Tuesday.

Public-sector IR is harder than corporate IR. Politicians need statements. Citizens need services that still run. Forensics compete with continuity. That pressure is exactly what extortion groups price in.

Ripple effects outside Germany

Canadian municipalities, universities, and crown corporations face the same economics. Insurance asks about offline backups and segmentation. Auditors ask about privileged access. Neither question helps at 2 a.m. when council email is down and someone is posting sample files to prove they are serious.

Law firms with government practices should expect incident intake, privilege questions, and breach-notification work to spike when a regional government is hit this visibly. Vendors in the supply chain get questionnaire follow-ups even if they were not touched.

Practical takeaways

• Test restore from immutable backups on a schedule that produces evidence, not a slide that says "backups OK."
• Map which systems hold data you cannot afford to publish. Segment and monitor admin paths into those enclaves.
• Run tabletop exercises that include "refuse ransom, prepare for leak" not only "pay or rebuild."
• Review legal hold and crisis comms plans before you need them on a holiday weekend.
• Independent assessments help boards understand exposure without waiting for a leak site screenshot.

Bottom line

Berlin is a reminder that ransomware outcomes are not binary. Sometimes the data ships whether or not systems come back online. Forensic Five provides scoped security assessments and consulting for organizations that need clear documentation, from St. Albert, Alberta across Canada. We assess, report, and stay out of the sales theater.