Berlin is being blackmailed by hackers, mayor says
Kai Wegner says the German capital and city-state would not cave in to a ransom demand for data stolen in a cyber-attack.
Berlin's mayor, Kai Wegner, has declared that the German capital will not yield to a ransom demand from hackers who infiltrated city systems and stole data earlier this month.
Wegner confirmed that the ransom request was received on Thursday evening but did not disclose the amount. However, Der Spiegel reports that the hackers are seeking 30 Bitcoin, equivalent to approximately €2 million (£1.7 million).
The cyberattack forced the shutdown of some of Berlin's online systems, and investigators are currently working to determine the extent of the data breach.
The Rhysida group, believed to operate from Russia and Eastern Europe and previously responsible for an attack on the British Museum, has reportedly claimed responsibility. According to Reuters, the group announced on its website its intention to begin auctioning off the 5.79 terabytes of stolen Berlin data in seven days.
"Berlin will not be blackmailed," Wegner stated on Friday. He added that state police, prosecutors, and federal security services are "with the utmost urgency" investigating the suspected perpetrators, and inquiries into the "content and scope of the compromised data are being pursued with great intensity."
City-state officials indicated that an initial data leak occurred between August 7 and 12. Subsequently, on August 14, two department networks were shut down, disrupting applications for housing benefits and payments for several days. Forensic investigations have since uncovered further data leaks within Berlin's transport and environment department.
"It cannot be ruled out that personal or other non-public data may also be affected," the mayor's office said in a Friday statement.
While authorities in the capital have not publicly named the suspected cyber-attackers, Der Spiegel published a screenshot from the Rhysida group's dark web site. The screenshot claims possession of files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details. The site also displays a countdown, after which it states it will begin auctioning the data with a starting price of 30 Bitcoin, matching the ransom amount demanded from Berlin.
Studies indicate that the Rhysida group has claimed hundreds of attacks since its emergence in 2023, targeting government institutions and businesses of various sizes across numerous countries. In 2023, the group successfully infiltrated the British Museum's computer systems, disrupting services and stealing approximately 500,000 files. When the UK institution refused to pay the ransom, the group published the files, which contained personal data of visitors, subscribers, and staff, on the dark web.
The Berlin cyber-attack occurs roughly a month before the city's elections, though state senator Iris Spranger has affirmed that election infrastructure remains uncompromised.