A Fake Captcha Asked One Berlin Employee to Paste a Command. It Cost the City 5.79 TB Data.

In August 2026 the German capital got hit by a ransomware group called Rhysida, and the numbers are grim. Roughly 1.44 million files, about 5.79 terabytes, published on the dark web after Berlin refused to pay 30 Bitcoin, worth around €2 million. Court records, payroll data, passports, and vulnerability assessments of the city’s water supply, all dumped in the open. I want to walk through how it happened, because the entry point is a trick anyone can fall for, and the part that turned a breach into a disaster is a timing failure the city could have avoided.

Who Rhysida is

Rhysida is not a new name to anyone who tracks ransomware. The group runs a ransomware as a service operation, where affiliates rent its tools and split the proceeds, and authorities believe it is based in Russia or a Russian speaking country, partly from Russian language comments in its code. It has a track record of hitting public institutions and critical services. The British Library in October 2023, the Chilean Army, Seattle-Tacoma International Airport, the Maryland Department of Transportation, and the City of Columbus, Ohio, where it posted more than 3 terabytes after a failed extortion attempt. That Columbus demand was also 30 Bitcoin, the same figure it put on Berlin, which tells you the number is a standard opening bid rather than a calculation of what Berlin could pay.

How one pasted command opened the door

The way in was a fake captcha. An employee landed on a manipulated website showing what looked like a routine Cloudflare check, the kind everyone clicks through without thinking. Instead of a checkbox, the page quietly copied a command to the clipboard and walked the user through opening Windows Terminal and pasting it in, while the fake captcha kept displaying more steps to seem legitimate. The pasted command fetched the first stage of the malware in the background. The German cybersecurity agency, the BSI, calls this variant TerminalFix and attributes it to Rhysida.

This family of attack has a name, ClickFix, and it is spreading because it sidesteps the defenses companies rely on. Email filters and endpoint tools are built to stop malicious attachments and downloads. Here the user runs the command themselves, by hand, so from the machine’s point of view a person simply opened a terminal and typed. There is no attachment to scan and no download to flag at the moment it matters. The whole attack is engineered to make a careful person feel like they are following normal instructions.

How a fake captcha turns a routine click into a running command. Each step is designed to look like an ordinary robot check. Source: BSI, Cyberdise, Sept 2026

What was behind the door

That single machine sat inside the network of 2 Senate departments, Mobility, Transport, Climate Protection and the Environment, and Urban Development, Building and Housing. Once inside, the attackers found something that made the rest easy. Passwords were sitting in ordinary office files in plain text, including credentials for building management systems, a payment database, and administrator accounts. Reporting puts the number of files containing passwords in the thousands.

Plaintext passwords in office documents are the kind of thing security teams warn about for years and that keep happening anyway. They turn a single compromised workstation into a skeleton key. Exactly how the attackers moved from that one machine to the full data holdings of both departments has not been explained publicly, but the stored credentials are the obvious bridge.

The 7 days that cost Berlin everything

This is the part that should have gone differently. Data started leaving the network on 7 August, and the Mobility department detected that outflow the same day. Berlin saw the breach on day 1. The 2 affected departments were not disconnected from the state network, the Berliner Landesnetz, until 14 August. That is a gap of 7 days between noticing data leaving and actually pulling the plug, and that week is when the archive walked out the door.

Put that next to the usual numbers and the failure is clear. Sophos measured a median ransomware dwell time of 4 days in 2025, the time attackers sit undetected before acting. Mandiant’s 2026 figures put the median at 14 days, or 9 when the victim spots the breach themselves. Berlin did the hard part well, it detected the intrusion immediately. Then it took 7 days to contain what it had already seen, and in a data theft the containment speed is the whole game, because every day of access is more files gone.

Berlin detected the breach on day 1 and took 7 days to disconnect. The exfiltration happened inside that gap. Source: Tech Times, Berlin Senate timeline, Sept 2026

Berlin’s detect to isolate gap against industry dwell time benchmarks. Spotting the breach was never the weak point. Source: Sophos, Mandiant, Tech Times, Sept 2026

The money that was saved before the breach

There is a budget story underneath the timeline, and it is the part that should worry other governments. The urban development department’s attack detection software was licensed for only 5% of its devices, according to reporting by rbb24. The computer that the attackers used as their entry point sat outside that coverage, and so did the servers the data was pulled from. The department said expanding the coverage was not possible for financial reasons.

The financial reasons have numbers attached. Berlin’s state IT budget line fell from €32.2 million to €18.2 million for 2025, and €2 million was cut specifically from intrusion detection, per netzpolitik.org. A 2023 internal security report had reportedly called for expanding exactly the kind of detection that was later cut. I do not think anyone can prove the cuts caused this breach, and the reporting is careful to say so. The pattern is hard to miss, though. The tools that might have flagged the entry machine were the tools that got trimmed to save money the year before.

Berlin refused to pay, and what that meant

On 28 August, Rhysida posted a “Berlin, Germany” listing on its leak site with a countdown and a demand for 30 Bitcoin. Mayor Kai Wegner said the same day that the city would not be blackmailed, and the state’s chief digital officer repeated the position days later, calling it an attack on the state itself. Berlin kept its money.

I think refusing was the right call, and I also want to be honest that it came with a price paid by other people. When the deadline passed on 4 September, Rhysida published the files. The refusal denied criminals a payout and signaled that extortion does not work on the German state, which matters for every future target. It also meant real citizens’ court records, payroll details, and passport scans went public. There is no clean version of this choice. Paying funds the next attack and guarantees nothing, refusing protects the public purse and exposes the public. Berlin chose the second, which is the position most security agencies recommend, and the cost landed on residents.

What Berlin actually lost

The archive deserves a concrete accounting, with one caveat up front. Every figure here comes from Rhysida’s own claims on its leak site, and Berlin has not confirmed the scope while forensic review continues. Berlin’s own chief digital officer put the count at roughly 1.3 million files, a little below the attacker’s 1.44 million, which is a reminder to treat the group’s numbers as a ceiling rather than a measurement. With that caveat, the group claims personal information on 12,076 people, 16,389 email addresses, 11,963 phone numbers, and 148 bank account numbers. It claims more than 5,000 personnel files, passports and ID cards pulled from those records, court cases, disciplinary proceedings, and committee protocols. The exposure reached the top of the departments it hit. Among the leaked records were a copy of Transport Senator Ute Bonde’s own ID and her digital signature, which shows this was not limited to junior staff.

The part that moves this from a privacy disaster to a security one is the infrastructure material. Rhysida claims more than 8,000 infrastructure files, including vulnerability assessments of Berlin’s drinking water supply, and documents tied to chemical, biological, radiological, and nuclear threat planning. A vulnerability assessment of a water grid is a map of where to hit it. Even unconfirmed, that category of document being loose on the dark web is a different order of problem than leaked email addresses.

The human cost was immediate too. During the 14 to 23 August disconnection, housing benefit applications and payments were suspended for more than 50,000 households, because the systems that process them were offline. The breach leaked data and also stopped a core government service for over a week.

The lesson that applies to everyone

2 things from this generalize past Berlin. The first is that the entry point needed no sophisticated exploit, just a convincing fake captcha and one person following what looked like normal instructions. The defense is boring and human, teaching people that no legitimate captcha ever asks you to open a terminal and paste a command, and treating that specific prompt as an immediate red flag. The second is that detection without fast response buys you almost nothing. Berlin saw the attack on day 1 and still lost everything, because 7 days passed before it cut the connection. For any organization holding data worth stealing, the drill worth running covers how fast you notice and, just as much, how fast you can disconnect once you do.