Berlin’s city government is investigating a cyber extortion campaign after hackers breached municipal systems, stole data and demanded a ransom reportedly worth about €2 million in bitcoin. The Rhysida ransomware group has claimed responsibility and threatened to auction the stolen files.
What happened in the Berlin ransomware attack?
Officials said the initial data leak occurred between August 7 and 12. Investigators later identified additional exposure involving Berlin’s transport and environment department, suggesting the breach may have affected more of the city administration’s network than initially believed.
On August 14, Berlin shut down two departmental networks to contain the intrusion. The disruption temporarily prevented officials from processing housing benefit applications and related payments.
The mayor’s office later acknowledged that “it cannot be ruled out that personal or other non-public data may also be affected,” revising its earlier position that only public information had been compromised.
Rhysida claims responsibility and demands 30 bitcoin
Rhysida, a ransomware group believed to operate from Russia and Eastern Europe, has claimed responsibility for the attack. The group says it stole 5.79 terabytes of data, although Berlin authorities have not independently confirmed the amount or the full scope of the breach.
According to Der Spiegel, the attackers are demanding 30 bitcoin, valued at roughly €2 million at current exchange rates. A listing on the group’s dark web site reportedly includes a countdown timer and sets 30 bitcoin as the starting price for an auction of the stolen data.
Rhysida has reportedly threatened to release or auction the files if Berlin does not pay. Reuters reported that the group said it would act within seven days of its public claim. The attackers are also reportedly invoking potential GDPR penalties in an effort to pressure the city into paying.
Berlin refuses to pay the ransom
Mayor Kai Wegner said the ransom demand arrived on Thursday evening and confirmed that Berlin would not negotiate under pressure. “Berlin will not be blackmailed,” he said Friday.
Wegner did not publicly confirm the amount demanded. The Berlin Senate Chancellery told German news agency dpa that it could not comment on the attackers, their demands or the compromised information “for investigative reasons.”
Police and security agencies investigate
State police, prosecutors and federal security services are investigating the suspected perpetrators “with the utmost urgency.” Authorities are also working to determine “the content and scope of the compromised data.”
State Senator Iris Spranger said election infrastructure had not been compromised. The clarification comes roughly a month before Berlin is due to hold elections.
Who is Rhysida?
Rhysida has operated since 2023 and has previously targeted healthcare organizations, state governments, education institutions and critical infrastructure operators.
The group was linked to a 2023 attack on the British Museum, in which it reportedly disrupted services and stole approximately 500,000 files. After the museum refused to pay, Rhysida published personal data belonging to visitors, subscribers and staff on the dark web.
The Berlin case highlights the growing use of data theft, public disclosure threats and regulatory pressure in ransomware attacks against government institutions. It also raises the prospect that Berlin’s refusal to pay could lead to a public release or auction of the stolen information if the attackers follow through on their deadline.
Frequently asked questions
Who is responsible for the ransomware attack on Berlin?
The Rhysida group, believed to operate from Russia and Eastern Europe, has claimed responsibility for the attack.
What data was stolen during the Berlin ransomware attack?
Rhysida claims to have stolen 5.79 terabytes of data, including government records, personnel files and financial information. Berlin authorities have not confirmed the claim or the complete nature of the stolen data.
How has Berlin responded to the ransom demand?
Berlin officials, led by Mayor Kai Wegner, have refused to pay the ransom. Wegner said, “Berlin will not be blackmailed.”
What is the current status of the investigation?
State police, prosecutors and federal security services are investigating the incident, while officials work to establish the extent of the breach and determine whether personal or other non-public information was affected.
