BREACH WATCH BRIEF Critical 💀 Ransomware

Berlin Confirms 5.79 TB Data Theft After Rhysida Ransomware Threat

Berlin’s administration verified that the Rhysida ransomware gang exfiltrated ~5.79 TB of data and is threatening public release. The breach highlights gaps in incident‑response evidence collection and continuous monitoring required for audit readiness.

ADTP Breach Watch · August 31, 2026 · BleepingComputer

SeverityCritical

Type💀 Ransomware

ConfidenceHigh

ReportedAug 31, 2026

Government & Public Sector Public sector (state governments, critical infrastructure) Any third‑party services handling Berlin’s data Unknown Ransomware

What happened

In mid‑August 2026, the Rhysida ransomware group accessed Berlin’s administrative network, stole approximately 5.79 TB of data across 1.44 million files, and posted a demand for payment on their leak site on 28 August.

Why it matters for trust and compliance

The episode underscores the necessity of a continuous‑control‑assurance program that documents detection, containment, and forensic evidence, satisfying incident‑response objectives across multiple frameworks.
Map incident‑response controls to VCF and capture real‑time evidence for audit readiness.
Validate DLP and privileged‑access monitoring logs to demonstrate ongoing compliance.

Who is affected

Public sector (state governments, critical infrastructure) Any third‑party services handling Berlin’s data

Recommended actions

Activate and document your incident‑response plan; preserve logs and forensic images.
Perform a control‑gap assessment against the incident‑response objective of VCF and map to NIST CSF 2.0.

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.