Berlin Mayor Kai Wegner stated that the city is facing a ransomware attack from hackers who compromised city systems and stole data earlier this month. Wegner emphasized that officials would not comply with the ransom demand made on Thursday evening. Although the exact amount demanded was not disclosed, Der Spiegel reported that the hackers are seeking 30 bitcoin, valued at approximately €2 million (£1.7 million).
As a result of the attack, some of Berlin's online systems were shut down, and investigators are currently assessing the extent of the data breach. The Rhysida group, believed to operate from Russia and Eastern Europe and responsible for a previous attack on the British Museum, has claimed responsibility for the attack. According to news agency Reuters, the group announced plans to auction the 5.79 terabytes of stolen data in seven days.
"Berlin will not be blackmailed," Wegner stated on Friday. He noted that state police, prosecutors, and federal security services are investigating the suspected perpetrators with urgency, and inquiries into the nature and extent of the compromised data are ongoing.
City officials reported that an initial data leak occurred between August 7 and 12. Following this, on August 14, two department networks were shut down, disrupting applications for housing benefits and payments for several days. Forensic investigations have since revealed additional data leaks within Berlin's transport and environment department.
The mayor's office indicated that it cannot be ruled out that personal or other non-public data may have been affected. Although authorities have not publicly named the suspected cyber-attackers, Der Spiegel has shared a screenshot from the Rhysida group's dark web site, which claims to possess files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details. The site also features a countdown to when the data auction will begin, with a starting price of 30 bitcoin, matching the ransom demand from Berlin.
The Rhysida group has claimed responsibility for hundreds of attacks since its emergence in 2023, targeting government institutions and businesses across various countries. In a previous incident, the group infiltrated the British Museum's computer systems, disrupting services and stealing around 500,000 files. When the museum refused to pay the ransom, the group published the files, which contained personal data of visitors, subscribers, and staff, on the dark web.
The cyber-attack on Berlin comes approximately one month before the city is scheduled to hold elections, although state senator Iris Spranger assured that election infrastructure had not been compromised.