en.cryptonomist.ch
Berlin’s city government is facing a cyber extortion campaign that has already knocked out parts of its digital infrastructure and put officials in a standoff with hackers demanding a hefty bitcoin payout. The Berlin hacking blackmail case, confirmed by Mayor Kai Wegner this week, involves stolen government data, a ransom threat, and a countdown clock ticking toward a public data auction.
Key takeaways
- Berlin city systems were breached and data was stolen in an initial leak that occurred between August 7 and 12.
- Hackers are demanding 30 bitcoin, worth roughly 2 million euros, according to Der Spiegel.
- The Rhysida group, believed to operate out of Russia and Eastern Europe, has claimed responsibility and says it stole 5.79 terabytes of data.
- Mayor Kai Wegner says Berlin will not pay: “Berlin will not be blackmailed.”
- State police, prosecutors, and federal security services are investigating with what officials call “the utmost urgency.”
Ransomware Attack on Berlin City Systems
City officials say the breach began quietly, with data siphoned out of Berlin’s administrative network well before anyone went public about it. The Rhysida ransomware attack was first discovered internally in mid-August, though the group has reportedly taken responsibility.
Data Theft Timeline and Initial Response
According to city-state officials, the initial data leak occurred between August 7 and 12. That narrow window gave attackers enough access to pull sensitive files before investigators caught up. Forensic teams have since traced additional exposure to Berlin’s transport and environment department, suggesting the intrusion reached further into city systems than first assumed.
Impact on City Services and Network Shutdown
On August 14, officials pulled the plug on two department networks to contain the damage. That decision had real consequences for residents: applications for housing benefits and related payments became impossible to process for several days. The mayor’s office later acknowledged that “it cannot be ruled out that personal or other non-public data may also be affected,” a shift from Berlin’s earlier line that only public information had been compromised.
Rhysida Group Claims Responsibility and Ransom Demands
The group behind the intrusion, Rhysida, is no stranger to headline-grabbing attacks on public institutions, and its history gives the Berlin case an uncomfortable precedent to watch.
Profile and History of Rhysida
Rhysida has been active since 2023 and is thought to operate from Russia and Eastern Europe. The group has previously targeted healthcare organizations, state governments, education institutions, and critical infrastructure operators. Its most notable prior operation hit the British Museum in 2023, when it infiltrated the museum’s systems, disrupted services, and stole around 500,000 files. When the British Museum refused to pay, Rhysida published the personal data of visitors, subscribers, and staff on the dark web — a pattern that gives Berlin’s refusal added weight, given how the last standoff ended.
Details of Ransom and Data Auction Threat
Der Spiegel reports the attackers are seeking 30 bitcoin, a bitcoin ransom demand worth around 2 million euros at current exchange rates. Rhysida’s dark web listing reportedly shows a countdown timer set to a starting auction price matching that same 30 bitcoin figure. The group says it obtained 5.79 terabytes of data. The attackers are reportedly leaning on the threat of GDPR penalties to pressure the city into paying before the files go up for auction — a threat Rhysida says it will act on within seven days of its public claim, according to Reuters.
None of these details have been independently verified by Berlin authorities, who have declined to confirm the scope of what was taken while the investigation continues.
Berlin’s Official Response and Ongoing Investigations
City leadership has drawn a hard line publicly, even as investigators work behind closed doors to determine exactly what was exposed.
Ransom Refusal and Public Statements
Wegner confirmed the ransom demand landed Thursday evening and said officials would not give in. “Berlin will not be blackmailed,” he said Friday, declining to specify the exact sum being sought publicly even as Der Spiegel’s reporting pointed to the 30 bitcoin figure. The Berlin Senate Chancellery has otherwise stayed tight-lipped, telling German news agency dpa it could not comment on the attackers, their demands, or the compromised information “for investigative reasons.”
Law Enforcement and Security Agency Involvement
Wegner said state police, prosecutors, and federal security services are investigating the suspected perpetrators “with the utmost urgency,” with parallel efforts underway to pin down “the content and scope of the compromised data.” State senator Iris Spranger added that election infrastructure has not been compromised, a detail worth noting given that Berlin holds elections roughly a month from now.
Why this matters beyond Berlin: the case underscores how ransomware groups increasingly weaponize regulatory frameworks like GDPR to squeeze public institutions, betting that the threat of compliance fines and reputational fallout will do more to force payment than the data theft itself. It also shows how a refusal to pay — as Berlin has chosen and as the British Museum did before it — can shift the standoff from a private negotiation into a public data dump once the attacker’s deadline runs out.
FAQ
Who is responsible for the ransomware attack on Berlin?
The Rhysida group, believed to operate from Russia and Eastern Europe, has claimed responsibility for the attack.
What data was stolen during the Berlin ransomware attack?
Rhysida claims to have stolen 5.79 terabytes of data, including government records, personnel files, and financial information.
How has Berlin responded to the ransom demand?
Berlin officials, led by Mayor Kai Wegner, have refused to pay the ransom, stating “Berlin will not be blackmailed.”
What is the current status of investigations into the attack?
Multiple law enforcement agencies, including state police, prosecutors, and federal security services, are investigating the incident with urgency.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.