What Happened: Rhysida's 5.26 TB Leak
The ransomware group Rhysida has published 5.26 terabytes of data stolen from Berlin's state government on the dark web. The dump follows a familiar pattern for the group: infiltrate a network, exfiltrate large volumes of sensitive files, demand payment, and release everything publicly when the target refuses to pay. This latest disclosure is part of an ongoing saga that vpn.social has tracked closely, including Rhysida's earlier publication of nearly six terabytes of stolen Berlin data and the group's decision to dump Berlin data after the city refused a €2 million ransom demand.
Government data leaks of this size are rarely one-and-done events. They tend to unfold in stages, with initial threats, deadlines, partial releases, and eventually full publication once negotiations collapse. Berlin's case appears to follow that exact trajectory, culminating in this 5.26 TB release.
Who Is Rhysida and Why It Targets Public Institutions
Rhysida has been active since 2023 and has built a reputation for targeting two sectors in particular: healthcare organizations and public administrations. Its known victims include the Centro Hospitalar Universitário de Lisboa, a major hospital network in Portugal, and even the Vatican. This pattern is not coincidental. Hospitals, city governments, and religious institutions often run on legacy IT systems, operate under tight budgets for cybersecurity, and hold enormous volumes of sensitive personal and administrative data, exactly the kind of combination that makes them attractive targets for a group looking for high-value data with comparatively weaker defenses.
Public sector victims also face a unique dilemma when hit by ransomware. Paying a ransom to a criminal group raises legal and ethical questions, and there is no guarantee that payment prevents the data from being leaked or resold anyway. Refusing to pay, on the other hand, means the data becomes public, potentially exposing citizens, employees, and government operations to lasting harm. Berlin's government has previously been reported to have refused a ransom demand made in Bitcoin ahead of a set deadline, a decision that ultimately led to the data being dumped rather than sold or suppressed.
The Double Extortion Playbook
Rhysida operates using a tactic known as double extortion. Rather than simply encrypting files and demanding payment for a decryption key, the group first steals a copy of the data before locking systems down. This gives them two forms of leverage: victims are pressured to pay both to regain access to their own systems and to prevent the stolen data from being published or sold. If a ransom isn't paid, the group follows through by releasing the data publicly, as has happened repeatedly throughout the Berlin case, including in a prior release described as Berlin government data leaked after a ransom refusal.
Double extortion has become increasingly common among ransomware groups precisely because it works. Even organizations with solid backup systems that can restore encrypted files without paying still face the threat of public data exposure, which keeps the pressure on regardless of how well a victim's disaster recovery plan holds up.
What This Means For You
If you live in Berlin, work for the city's administration, or have any interactions with the affected government systems, this leak is worth paying attention to. Public administration data leaks like this one often include personal records tied to employees and residents, not just internal bureaucratic files. Even if you weren't directly notified, it's reasonable to assume that sensitive information tied to public services could be circulating on the dark web following a breach of this scale.
More broadly, this incident is a reminder that ransomware groups increasingly view public institutions, not just corporations, as prime targets. Healthcare systems and government bodies hold data that's difficult to replace and impossible to "un-leak" once it's out. That reality puts pressure on public agencies to invest in stronger cybersecurity defenses, but it also means individuals should stay alert for signs their own data has been exposed through no fault of their own.
Taking Action After a Government Data Leak
If you believe your information may have been part of this or a similar breach, there are practical steps worth taking. Monitor your accounts and any government-issued identification numbers for signs of misuse. Be cautious of phishing attempts that reference your personal details, since leaked data is often repurposed for follow-up scams. Consider using identity monitoring services if they're available to you, and stay informed through official government communications about the breach's scope and any support offered to affected residents.
The Rhysida ransomware saga in Berlin illustrates how a single ransom refusal can cascade into a massive, multi-stage data exposure event. As these incidents continue to unfold, staying informed about how your data may be affected remains one of the most effective ways to protect yourself in the aftermath.
