Welt counts 1.4 million records in the Berlin leak; FAZ measures the same haul at 5.8 terabytes

What happened. The countdown on the attackers' leak site ran out at about 15.35 on Friday; the package went up on the darknet an hour later, FAZ reports. Berlin refused to pay. Mayor Kai Wegner told Bild the aim now is to reach those affected “as fast as possible”.

The size is two measurements, not two counts.

Report	Figure	What it counts
Welt, citing rbb	1.4 million “Daten”, in three packages	not defined
Le Figaro, citing rbb	“plus d’un million de données volées”	not defined
Frankfurter Allgemeine	5.8 terabytes	the size of the package
HotNews.ro	no figure	—

One ransom, quoted three ways. FAZ and Welt both give 30 bitcoin, about €2 million. Le Figaro writes “l’équivalent”; HotNews puts “over €2 million” in its headline. One demand, converted. All say Berlin refused it.

Our own two blind passes differ. Both counted two of the three cited reports giving a size; one headed its section “Three sizes”. One recorded that two reports set the attack against Berlin’s 20 September election; the other never raised the election.

Not settled. What one of the 1.4 million records is — a file, an entry, a person. Whether the records and the terabytes measure the same haul. Who did it: Welt and FAZ state Rhysida, Le Figaro adds “non confirmées officiellement”, and no police, BSI or Senate confirmation is in anything we hold.

What this is about. Criminal hackers broke into the computer network of Berlin's city government, stole its files and published them online after the city refused to pay a ransom.

How it got here. - Berlin is both a city and one of Germany's 16 states. It is run by the Senate, led by the Governing Mayor. Kai Wegner (CDU) has held that office since 2023, at the head of a coalition with the SPD. - The attack hit on 14 August, Le Figaro and HotNews.ro report. Several departments, including housing and environment, were cut off for a week, and housing-benefit claims and payments stopped for days, Le Figaro reports. - This kind of attack is called ransomware. A gang gets into a network, copies or locks its data, and demands money. If the victim does not pay, the gang publishes the data. The demand here was 30 bitcoin, about €2 million, according to Welt and HotNews.ro. - Berlin refused. Wegner told Bild that nobody could guarantee the data would be deleted after a payment. The deadline ran out on Friday 4 September and the files were published.

Who is involved. - Berlin's Senate: the victim, and the body that must tell affected staff, residents and companies. HotNews.ro reports that German and EU data-protection rules require it to. - The federal government: Der Spiegel found files on the expansion of the Chancellery, the federal chancellor's office, in the published data. A federal spokesman told Welt the government's own systems do not appear to be affected. - The attackers: Welt and HotNews.ro name the group as Rhysida. Le Figaro says this is not officially confirmed. Le Figaro and HotNews.ro report that Rhysida claimed the 2023 attack on the British Library in London.

What is at stake. Personal data of public employees and residents: pay lists, bank details and identity scans, Der Spiegel reports. Also fire-service safety plans, which a security expert warned Der Spiegel could help someone planning to harm the city.

Where it stands. The attack came a month before Berlin's 20 September election. The reports we hold were all published before the vote. Wegner first said there were no signs sensitive data had been taken. Welt reports he now says that has changed, and the files are still being checked.

What is being argued about

What one of the 1.4 million "Daten" is — a file, a record or a person. No report we hold defines the unit.
Whether that 1.4 million and FAZ's 5.8-terabyte package are the same haul measured twice, or two different things.
Whether Rhysida is responsible: two reports state it flatly, Le Figaro calls the naming officially unconfirmed, and no police, BSI or Senate confirmation is in anything we hold.
Who was actually harmed. Every report lists the categories — salary lists, bank details, ID scans, disciplinary files — and none names a person whose data is now public.

Four reports on one leak: the size, the ransom and the nameSide by side

Report	How big	The ransom	Who did it
Welt	1.4 million "Daten", in three packages, citing rbb	€2 million demanded; Berlin refused	Rhysida, citing rbb — stated
Frankfurter Allgemeine	a 5.8-terabyte package	30 bitcoin, about €2 million; not paid	Rhysida — stated
Le Figaro	"plus d'un million de données volées", citing rbb	about €2 million; Wegner refused again	Rhysida — "non confirmées officiellement"
HotNews.ro	no figure in the report we hold	"over €2 million", in the headline	"a ransomware group" — not named

Read across: the two figures are in different units. Only Le Figaro says the attackers' name is unconfirmed.

Sources

Welt

Le Figaro

HotNews.ro

Three weeks from the break-in to the leak, then eleven hours of coverageTimeline

Fri 14 Aug— no time published Rhysida takes the data off the Berlin state network unnoticed, Welt reportsLe Figaro and HotNews both date the attack to this day; Welt gives it no date
Fri 4 Sep15:35 printed in the report — "gegen 15.35 Uhr" Rhysida lets the countdown on its leak site run out 30 bitcoin unpaid
Fri 4 Sep— no time published; FAZ says about an hour after the countdown Rhysida publishes the package on the darknet 5.8 terabytes
Sat 5 Sep07:47 published time we hold, UTC Frankfurter Allgemeine reports the release and a BSI warning of raised cyber threat 5.8 TB · 30 bitcoin
Sat 5 Sep12:19 published time we hold, UTC Welt carries an IT security consultant accusing Berlin of gross negligence 1.4 million records
Sat 5 Sep18:24 published time we hold, UTC HotNews.ro reports the leak, ransom in the headline over €2 million
Sat 5 Sep18:53 published time we hold, UTC Le Figaro leads on Wegner admitting sensitive data was stolen more than 1 million records
Sat 5 Sep— no time published Welt reports Der Spiegel's first sample of the files 1.4 million records

Published times are the ones we hold, in UTC; Berlin was two hours ahead. Where a report carries no time we say so.

Sources

Welt

Le Figaro

HotNews.ro

More from the reportingFacts optional section

Der Spiegel's first sample of the leak found fire-service risk-protection data, salary lists, bank details, scans of identity papers and confidential personnel files — plus more than 550 files on the extension of the German Chancellery. Welt →
Berlin's housing and environment offices were cut off the network for a week after the 14 August attack; housing benefit could not be claimed or paid for several days. Le Figaro →
Rhysida claimed the 2023 attack on the British Library, demanded the equivalent of more than €760,000, and put about 500,000 files online when the library refused to pay. Le Figaro →
IT security consultant Manuel Atug told dpa he was called before Berlin's interior committee in 2023 and again in 2025 and warned it then: "Ihr betreibt desolate Cybersicherheit." Welt →
Berlin votes on 20 September, about a month after the attack. Le Figaro says the vote is not called into question by it. Le Figaro →
The federal government checked its own systems after the leak and said they were not affected "as far as is known so far"; a spokesman said it is following the investigation closely. Welt →

Facts carried by one report each, which the others do not have.

Sources

Welt

Le Figaro

The bias in this coverageBias

Two counts of one leak, neither saying what it counts

Two of the three reports size the leak, at 1.4 million and at more than a million, and neither says what one of those records is. The larger figure comes with three packets in one sentence and several packets a few lines later, inside the same report. Two name the group behind it; one of those two adds that the name is not officially confirmed.

2 reports giving a size for the leak 0 reports saying what one leaked record is 2 reports naming the group behind it 1 reports saying that name is unconfirmed

Who is shown as harmed, and when it happened

One report says what the attack did to people outside city hall: housing and environment offices off the network for a week, benefit claims and payments impossible for days. None of the three names anyone whose salary list, bank details or ID scan is now in the open, though all three list those categories. Two date the attack to 14 August; the report carrying the most detail gives no date for it anywhere.

1 reports saying what the attack did to residents 0 reports naming anyone whose data was taken 2 reports dating the attack 1 reports quoting someone outside city hall

Scored without the mastheads. Where the two passes differ, both are kept.

Sources

Welt

Le Figaro

HotNews.ro

Claims and verdicts

misleading The Berlin leak is 1.4 million files — almost six terabytes.

These are a count and a volume, not two rival counts: the 1.4 million "Daten" is rbb's figure, reaching us through Welt and, as "plus d'un million", through Le Figaro, while FAZ's "rund 5,8 Terabyte" measures the size of the package put on the darknet. No report we hold says whether one "datum" is a file, a record or a person, and the HotNews report we hold gives no size at all.

Checked against 3 sources:

Welt

Le Figaro

HotNews.ro

true The attackers demanded a ransom of 30 bitcoin, about €2 million, and Berlin refused to pay.

FAZ and Welt both give the demand as 30 bitcoin, converted at roughly two million euros, which is why HotNews writes "over €2 million" and Le Figaro "l'équivalent" — the euro figures are conversions of one bitcoin sum. Welt, Le Figaro and FAZ all report the Senate refusing to pay, with Wegner quoted in Bild on why.

Checked against 2 sources:

Welt

Le Figaro

unverified The Rhysida ransomware group carried out the attack.

FAZ and Welt name Rhysida flatly, Welt citing rbb, and the only thing behind the name in what we hold is the group's own leak site and countdown. Le Figaro names it too but says so explicitly: "Des informations non confirmées officiellement" — no police, BSI or Senate confirmation appears in any report we hold.

Checked against 2 sources:

Welt

Le Figaro

Who wrote it

L Le Figaro avec AFP Le Figaro

What the bias passes found in their reporting

Asserted, not attributed the capture of the strait and a "lightning offensive" are stated flat, with no source and no date×1

Asserted vs attributed The capture of the strait is stated flat, as settled background to a different story, with no source and no date for the claim.×1

Attacker identified by nationality in the headline; the other two reports do not give it×1

Attacker identified by nationality in the headline×1

Claims we checked that rest on their reporting

4 misleading8 disputed27 unverified22 true

From 3015 reports we hold under this byline, at Le Figaro. Two independent readings, each made without the masthead, a quote attached to every tag. A record, never a rating. Their full record →

V Vladimir Ionescu HotNews.ro

What the bias passes found in their reporting

Cause named, actors active the blockade is given a cause and a date, with the United States and Israel named as having struck first×1

Charge headlined Merz's war-crimes charge is carried into the headline×1

Comparison carried the Weimar comparison is reported as the president's warning×1

Dating and attribution dates the attack and sets it against an election two weeks away; one report we hold dates neither×1

Claims we checked that rest on their reporting

1 misleading7 unverified3 true

From 304 reports we hold under this byline, at HotNews.ro. Two independent readings, each made without the masthead, a quote attached to every tag. A record, never a rating. Their full record →

The bylines on the reports this story is built from. Hover one for what our passes have measured on their reporting. · 1 report we hold carries no byline — we do not invent one.

Coverage, outlet by outlet

Welt — independent

Hackerangriff: Zahlreiche sensible Daten landen im Darknet – darunter Gehaltslisten und Interna aus dem Kanzleramt - WELT

The only report we hold that puts on the record what Wegner said before he conceded the theft — that there was no sign of sensitive data leaving — and the only one carrying the note the attackers attached to the files

Nach dem Hackerangriff auf die Stadt Berlin sind laut einer Stichprobe des Nachrichtenmagazins „Spiegel“ (verlinkt auf https://www.spiegel.de/panorama/hackerangriff-in-berlin-gehaltslisten-kontoinformationen-kanzleramts-plaene-das-ist-zum-leak-bekannt-a-bb6ae0de-e978-4d58-9e05-80383f156b68) zahlreiche sensible Daten im Darknet zu finden. Bei einer ersten schnellen Sichtung fand das Magazin laut Mitteilung vom Samstag etwa Daten zum Gefahrenschutz bei der Berliner Feuerwehr, Gehaltslisten, Kontoinformationen, Scans von Ausweispapieren, und vertrauliche Personalangelegenheiten wie Vorwürfe zu Di

Which figure is used: Counts 1.4 million pieces of data in three packets and never says what one piece is; a few lines later the same report makes it several packets. — “Die Hacker, die mit ihrem Cyberangriff zwei Millionen Euro Lösegeld erpressen wollten, haben nach Ablauf der Frist am Freitag rund 1,4 Millionen Daten in drei Paketen zum Download angeboten, versehen mit dem Kommentar „Viel Spaß, Datenjäger“.”

Who is named as acting: The only report that says what the mayor had said before he admitted the theft. — “Wegner hatte zunächst erklärt, es gebe keine Hinweise auf den Abfluss sensibler Informationen.”

How deeply it is sourced: The only report that puts anyone outside city hall, the hackers or another newsroom on the record. — “Die Sicherheitsexpertin Bianca Kastl warnte gegenüber dem „Spiegel“ vor den Missbrauchsmöglichkeiten”

How deeply it is sourced: the only report to put the mayor's earlier position on the record before his concession — “Wegner hatte zunächst erklärt, es gebe keine Hinweise auf den Abfluss sensibler Informationen.”

Which figure is used: 1.4 million in three packages, but the report never says what one of them counts — “haben nach Ablauf der Frist am Freitag rund 1,4 Millionen Daten in drei Paketen zum Download angeboten, versehen mit dem Kommentar „Viel Spaß, Datenjäger“.”

Read it at Welt → https://www.welt.de/politik/article6a9c2d67181cb962d4884af8/hackerangri…

Le Figaro — independent

Allemagne: après une cyberattaque, le maire de Berlin admet le vol de données sensibles

The only one that shows the cost outside city hall — housing and environment offices off the network for a week, housing benefit impossible to claim or pay for days — and the only one that flags the naming of Rhysida as

Le maire de Berlin a admis que des données sensibles avaient été volées à l'administration de la ville, victime d'une cyberattaque en août, ajoutant vouloir contacter «le plus rapidement possible» les personnes concernées, dans un entretien paru samedi. Le gouvernement allemand «suit de près les informations et l'enquête concernant cette fuite de données», a par ailleurs indiqué un porte-parole. Parmi les données sensibles concernées, l'hebdomadaire allemand Der Spiegel a cité la protection contre les risques au sein des pompiers berlinois, des listes de salaires, des informations bancaires, d

How hard the claim is stated: Names the group, then withdraws the certainty in a sentence of its own; the other report that names it does not. — “Selon des médias allemands, les maîtres chanteurs, qui avaient réclamé à Berlin l'équivalent environ 2 millions d'euros, seraient le groupe de hackers Rhysida. Des informations non confirmées officiellement.”

How the victims appear: The only report that says what the attack cost residents rather than institutions. — “A cause de cette cyberattaque survenue le 14 août à Berlin, plusieurs administrations de la ville, notamment celles consacrées au logement et à l'environnement, avaient été coupées du réseau pendant une semaine: toute demande d'allocation logement et leur versement, avaient été impossibles pendant plusieurs jours.”

How hard the claim is stated: the only report to flag the naming of the group as unconfirmed, and it uses the conditional to do it — “Selon des médias allemands, les maîtres chanteurs, qui avaient réclamé à Berlin l'équivalent environ 2 millions d'euros, seraient le groupe de hackers Rhysida. Des informations non confirmées officiellement.”

How the victims appear: the only report where a Berlin resident is affected by anything — “toute demande d'allocation logement et leur versement, avaient été impossibles pendant plusieurs jours.”

Read it at Le Figaro → https://www.lefigaro.fr/flash-actu/allemagne-apres-une-cyberattaque-le-…

HotNews.ro — independent

Criză la Berlin după un atac cibernetic. Hackerii au publicat datele, după ce au cerut o răscumpărare de peste 2 milioane de euro

The only report we hold with the ransom in its headline — "over €2 million" — and the only one saying investigators are still trying to gauge the scale. It does not name the group, and our copy of it breaks off after

Berlin, Germania. FOTO: Sean Pavone | Dreamstime.com Actualitate Criză la Berlin după un atac cibernetic. Hackerii au publicat datele, după ce au cerut o răscumpărare de peste 2 milioane de euro Vladimir Ionescu Publicat 05.09.2026 21:24 · Actualizat 05.09.2026 22:56 Adaugă-ne ca sursă preferată în Google Urmărește-ne în Google Discover Guvernul local din Berlin a declarat sâmbătă că analizează cu cea mai mare atenție un volum mare de date furate, publicat de un grup de ransomware. Dacă vă faceți în septembrie un abonament anual la HotNews Premium, un profesor primește gratuit un abonament pe

Dating and attribution: Dates the attack in its second sentence and immediately measures it against the election a month later; the fullest report we hold gives no date at all. — “Atacul cibernetic asupra rețelei Berlinului a avut loc în 14 august, cu aproximativ o lună înainte ca orașul-land să organizeze alegeri, pe 20 septembrie.”

Who is named as acting: perpetrator left unnamed as a ransomware group, where two other reports name it — “Guvernul local din Berlin a declarat sâmbătă că analizează cu cea mai mare atenție un volum mare de date furate, publicat de un grup de ransomware.”

Dating and attribution: dates the attack and sets it against an election two weeks away; one report we hold dates neither — “Atacul cibernetic asupra rețelei Berlinului a avut loc în 14 august, cu aproximativ o lună înainte ca orașul-land să organizeze alegeri, pe 20 septembrie.”

Read it at HotNews.ro → https://hotnews.ro/criza-la-berlin-dupa-un-atac-cibernetic-hackerii-au-…

We could not read these

D De Telegraaf P Público

ABC D De Standaard

Deník N

El Mundo

Corriere della Sera

Brussels Signal

Kathimerini

Dagens Nyheter

Digi24

Le Soir

Efimerida ton Syntakton

Der Standard

Die Presse

Observador

Il Giornale

Euractiv

Telex

Le Monde

Frankfurter Allgemeine

Rzeczpospolita

El País

la Repubblica

Magyar Nemzet

Politico Europe

Süddeutsche Zeitung

iDNES.cz / MF DNES

NOS

Svenska Dagbladet

Gazeta Wyborcza

These are must-cite outlets for this desk that we did not manage to read when we built this story. That is a gap in our reach, not a silence on their part, and it is not evidence of anything about this story.

Read another desk

Sections

Registers

Desks

Welt counts 1.4 million records in the Berlin leak; FAZ measures the same haul at 5.8 terabytes

What is being argued about

Two counts of one leak, neither saying what it counts

Who is shown as harmed, and when it happened

Claims and verdicts

Who wrote it

Coverage, outlet by outlet