Berlin state data stolen in ransomware attack published online
A ransomware group called Rhysida published over 1.4 million files stolen from Berlin's state government after officials refused to pay a demand for 30 bitcoins. Authorities confirmed the exposure, which includes sensitive emergency plans and personal data of state employees and citizens. Berlin's government stated there's no current sign that its network remains compromised and is reviewing the leaked files to identify those affected.
- Rhysida demanded 30 bitcoin for file deletion
- Leak includes 1.4 million files, sensitive plans, and personal data
- Berlin refused to pay and confirmed the breach
- Officials say network no longer appears compromised
- Authorities will contact affected individuals after review
Sources covering this
More in Cybersecurity
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Breeze Comet targets Brazilian financial firms with fraud
A group known as Breeze Comet has targeted Brazilian banks, retailers, and e-commerce companies through sophisticated attacks since early 2024, according to Google Cloud and Mandiant. The organization uses malware and voice phishing to access internal payment systems and carry out fraudulent transfers. Google states that Breeze Comet is also using generative AI to develop new malware and may expand operations to parts of Latin America and Africa.
Microsoft detects mass phishing using hidden Unicode tags
Microsoft identified a large phishing campaign that uses hidden Unicode tag characters to disguise key words in emails, enabling attackers to evade spam filters and machine learning-based detection. Microsoft tracked this method, known as ASCII smuggling, in more than 2.3 million messages over two days. While invisible to recipients, these tags break up high-risk words like “credit” or “loan,” allowing them to slip past automated screening systems.
Phishing Campaign Poses as IT Staff on Microsoft Teams
A coordinated phishing operation dubbed 'Spring Ring' targeted more than 150 employees at at least 10 companies between January and April 2026, according to Palo Alto Networks' Unit 42. Attackers used external Microsoft Teams accounts to impersonate IT support, aiming to trick victims into installing remote monitoring or malicious software. Some attacks escalated to attempted NTLM relay attacks against company domain controllers. No successful compromises or losses were reported in the source.