Blog

Hackers published roughly 5.8 terabytes of data stolen from Berlin’s state government on August 28, 2026. City officials had refused to pay a ransom demand that expired that day. The Berlin ransomware city attack exposed more than 5,000 personnel files and payslips. It also exposed fine proceedings, confidential parliamentary committee documents, and vulnerability analyses of Berlin’s drinking water supply, according to Help Net Security.

The Rhysida ransomware group claimed responsibility for the attack. It is believed to operate out of Russia and eastern Europe. The group had demanded 30 bitcoin, worth roughly €2 million ($2.3 million), according to The Hacker News. The same group previously hit the British Museum.

Rhysida follows a clear pattern across its attacks. It breaches a target’s network first. Then it pulls out as much data as it can before detection, and threatens public release on a deadline to force payment. The tactic works because it shifts the cost for victims. A private ransom negotiation becomes a public data-exposure event, carrying reputational and legal consequences well beyond the ransom itself. Berlin’s refusal echoes a stance other European public-sector victims have taken this year. Government bodies increasingly treat paying ransoms as rewarding the tactic rather than resolving it.

How the Berlin ransomware city attack unfolded

The initial data leak happened between August 7 and 12. Affected Berlin departments were not disconnected from the state network until August 14. That gap, roughly seven days, gave the attackers extended access to internal systems. Some of the city’s online services shut down as a direct result, disrupting routine government functions while the network was isolated.

Berlin’s state executive said, as a matter of principle, it would not give in to extortion. It held that position through the deadline. When the deadline passed without payment, Rhysida released the stolen files publicly instead of continuing to hold them privately. That is a common escalation tactic once ransomware negotiations fail.

What was actually exposed

The released package included about 1.44 million files. Beyond personnel records and payslips, the leak reportedly held confidential parliamentary committee documents. It also held technical vulnerability analyses of the city’s drinking-water infrastructure. That raises concerns beyond privacy, reaching into potential physical infrastructure risk. City officials have not detailed how many residents or employees the personnel-file exposure affects.

Why the seven-day delay matters

Security researchers flag the week-long gap between the initial breach and full network isolation as a critical failure point. It gave Rhysida extra time to locate and extract sensitive files before Berlin cut off access. Ransomware response plans generally call for near-immediate isolation once a breach is detected. The delay will likely be a focus of any post-incident review.

What happens next for Berlin

Berlin’s government has not announced a timeline for restoring all affected online services. It also has not said when it will notify individuals whose personnel data appeared in the leak. Cybersecurity researchers continue analyzing the released files to map the full scope of exposure. That includes checking whether the drinking-water vulnerability data poses an ongoing risk needing separate remediation.

The incident lands amid a broader pattern of ransomware attacks on European public-sector targets this year. City and regional governments prove attractive because they often run older IT systems alongside genuinely sensitive records. Berlin’s stance against paying mirrors guidance from several national cybersecurity agencies across Europe. Those agencies generally discourage ransom payments, arguing they fund further attacks without guaranteeing stolen data is actually deleted. Employees whose personnel files appeared in the leak have limited recourse beyond monitoring for identity theft. The files are already public on the dark web and cannot be recalled.

Berlin’s experience is likely to influence how other German states approach network segmentation going forward. Security consultants typically recommend isolating a breached department immediately, not after a week’s delay. Whether Berlin implements that change before facing another attempt remains an open question the city has not yet addressed publicly.

The 5.8 terabyte figure places this among the larger public-sector leaks reported in Europe this year. Full comparisons are difficult, since not every victim discloses how much was taken. Journalists and researchers with leak-monitoring tools have begun cataloguing the exposed files. That process typically takes weeks, given the sheer volume involved. Standard practice after a leak like this is to watch for phishing attempts referencing personal details only a leaked file would contain. Stolen data is frequently reused in follow-on scams.

Frequently asked questions

What happened in the Berlin ransomware attack?
Hackers linked to the Rhysida group breached Berlin’s state government network in early August 2026 and stole data. They published about 5.8 terabytes of it after the city refused to pay a ransom.

How much ransom did the hackers demand?
Roughly 30 bitcoin, worth about €2 million ($2.3 million).

What data was exposed?
About 1.44 million files. That includes over 5,000 personnel files and payslips, plus fine proceedings, confidential parliamentary documents, and vulnerability analyses of Berlin’s drinking water supply.

Who is behind the attack?
The Rhysida ransomware group, believed to operate from Russia and eastern Europe, claimed responsibility. The group was previously linked to an attack on the British Museum.

Did Berlin pay the ransom?
No. City officials said as a matter of principle they would not pay, and the hackers released the stolen data after the deadline passed.

Related coverage

• For another major cloud and infrastructure disruption this year, see our report on the Microsoft cloud outage.
• See also our coverage of the American Tower data breach.

Sources

• Help Net Security — Berlin refuses to be blackmailed after network breach. helpnetsecurity.com
• The Hacker News — Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network. thehackernews.com

Apple holds its “Surprise and Shine” event on September 9, 2026 at 10am Pacific. It is the first product launch under new CEO John Ternus, who succeeded Tim Cook on September 1. The Apple September iPhone event is widely expected to include Apple’s first foldable device alongside iPhone 18 Pro updates, according to Bloomberg.

The event streams from Apple’s website, through the Apple TV app, or on YouTube. Rumors also point to new Apple Watch models and a redesigned AirPods lineup. A preview of a 7-inch smart home hub with a full display may also appear, according to reporting compiled by CNBC.

Why the Apple September iPhone event matters beyond the hardware

This is Ternus’s first public moment leading Apple’s product strategy. Investors and analysts will watch his presentation style as much as the devices themselves. Ternus previously led Apple’s hardware engineering division, which gives him deep technical credibility. But stepping into the keynote role that Cook, and before him Steve Jobs, held for decades is a different kind of test.

The company is positioning 2026 and 2027 as the start of its biggest run of device releases in its history, according to reporting from MacDailyNews. That framing casts the foldable iPhone as the opening move in a multi-year hardware push, not a one-off launch.

Ternus spent years running Apple’s hardware engineering division before moving into the CEO role. He oversaw the physical design and engineering of the iPhone, Mac, and iPad lines. That background gives him direct credibility on the decisions behind a first-generation foldable device, in a way a finance-focused executive might lack. It also raises the stakes. Early competitors struggled with hinge and durability problems on their folding phones. If Apple’s foldable ships with the same flaws, the criticism lands on the executive who spent over a decade solving exactly those engineering problems.

What’s expected to launch on September 9

Analysts expect three new iPhone models. That includes the rumored foldable device and updated iPhone 18 Pro variants, plus two new Apple Watch models. Reporting also points to a redesigned Apple TV box and HomePod mini hardware alongside the smart home hub preview. Apple has not officially confirmed any of these products. The company’s own invitations have not detailed specific products, consistent with its usual pre-launch practice.

The foldable iPhone question

Apple resisted the foldable phone category for years while competitors shipped multiple generations of folding devices. A first-generation Apple foldable arrives well after rivals worked through early design problems like screen creasing and hinge durability. That timing could let Apple learn from competitors’ mistakes. Whether that translates into a device that justifies its expected premium price is the open question analysts are watching for on September 9.

What happens after the keynote

When new iPhone models are announced, Apple has historically opened pre-orders within days. Shipping usually begins within two weeks of the keynote. Analysts will watch initial demand signals, especially for any foldable device. That gives an early read on whether Ternus’s first major product bet pays off. Apple’s fiscal Q4 earnings call, typically held in late October, will offer the first hard sales data tied to the launch.

Apple has not commented publicly on any of the rumored products ahead of the keynote. That silence is consistent with its long-standing practice of staying quiet until the stage presentation itself. It leaves outlets like Bloomberg, CNBC, and MacRumors to piece together expectations from supplier relationships and past product cycles, rather than official confirmation. The gap between rumor and confirmation is part of why September 9 matters. It is the first moment analysts, investors, and competitors get a verified account of what Ternus’s Apple actually built, rather than an assembled forecast.

Competitors will also be watching closely. Samsung and other foldable-phone makers have had the category largely to themselves for several product generations, and Apple’s entry could reshape how the broader smartphone market prices and markets folding devices. A strong Apple debut could validate the category for consumers who have been skeptical of folding phones, while a lukewarm reception could reinforce the view that folding screens remain a niche feature rather than the smartphone industry’s next major shift.

Frequently asked questions

When is Apple’s September 2026 event?
September 9, 2026, at 10am Pacific Time (1pm Eastern), streamed on Apple’s website, the Apple TV app, and YouTube.

Is this John Ternus’s first Apple keynote?
Yes. Ternus became Apple’s CEO on September 1, 2026, succeeding Tim Cook, and this event is his first major product launch in the role.

Will Apple launch a foldable iPhone?
It’s widely rumored but not officially confirmed. Reports point to Apple’s first foldable device debuting alongside iPhone 18 Pro updates.

What else might Apple announce?
Rumors point to new Apple Watch models, redesigned AirPods, and a new Apple TV box. A HomePod mini refresh and a preview of a smart home hub with a full display may also appear.

When would new iPhones ship?
Based on Apple’s past pattern, pre-orders typically open within days of the keynote and shipping begins within about two weeks.

Related coverage

• For Apple’s other major 2026 headline, see our report on the £2 billion UK antitrust lawsuit against Apple.
• For another major consumer tech legal story, read our coverage of the Sony PlayStation Store lawsuit.

Sources

• Bloomberg — What to Expect at Sept. 9 Apple Event. bloomberg.com
• CNBC — Apple sets iPhone launch event for Sept. 9, first under new CEO John Ternus. cnbc.com
• MacDailyNews — Apple’s Ternus era begins September 9th. macdailynews.com