Berlin is being blackmailed by hackers who compromised city systems and stole data earlier in August, Mayor Kai Wegner announced.
Wegner stated that officials would not yield to the ransom demand, which was issued on Thursday evening. While the specific amount demanded was not disclosed by the mayor, reports from Der Spiegel indicate the hackers are seeking 30 bitcoin, approximately €2 million.
Cyberattack Details
The attack forced some of Berlin's online systems offline and prompted an investigation into the scope of the data breach. The Rhysida group, believed to operate from Russia and Eastern Europe and previously linked to an attack on the British Museum, has reportedly claimed responsibility.
According to Reuters, Rhysida has stated its intention to begin auctioning the 5.79 terabytes of stolen data within seven days. "Berlin will not be blackmailed," Wegner declared on Friday.
State police, prosecutors, and federal security services are investigating the alleged perpetrators with high urgency. Inquiries are intensely focused on determining the content and extent of the compromised data.
City officials confirmed an initial data leak occurred between August 7 and August 12. Subsequently, on August 14, two departmental networks were shut down, disrupting services such as housing benefit applications and payments for several days. Forensic investigations later revealed further data leaks within Berlin's transport and environment departments.
"It cannot be ruled out that personal or other non-public data may also be affected," a statement from the mayor's office read on Friday. Although authorities have not officially named the attackers, Der Spiegel published a screenshot from the Rhysida group's dark web site claiming possession of files including contracts, non-disclosure agreements, personnel files, passwords, and numerous personal contact details.
Rhysida Group's History
The Rhysida group has claimed responsibility for hundreds of attacks since its emergence in 2023, targeting government institutions and businesses across various countries, according to studies. In 2023, the group successfully infiltrated the British Museum's computer systems, leading to service disruptions and the theft of approximately 500,000 files. After the UK institution refused to pay the ransom, Rhysida published the stolen data, which included personal information of visitors, subscribers, and staff, on the dark web.
The cyberattack on Berlin occurs approximately one month before the city's elections. State senator Iris Spranger has affirmed that the election infrastructure remains secure and has not been compromised.