Berlin's mayor, Kai Wegner, has said the city is being blackmailed by hackers who compromised city systems and stole data earlier this month. Wegner stated that officials would not give in to the ransom demand, which arrived on Thursday evening. He did not disclose the amount, but Der Spiegel reports that the hackers are demanding 30 bitcoin, worth around €2 million.
As a result of the attack, some of the German capital's online systems were forced to shut down, while investigators work to determine what data was taken. The Rhysida group, believed to operate from Russia and Eastern Europe and previously behind an attack on the British Museum, has reportedly claimed responsibility. According to Reuters, the group has stated on its website that it intends to auction the 5.79 terabytes of data stolen from Berlin within seven days.
"Berlin will not be blackmailed," Wegner said on Friday. He added that state police, prosecutors, and federal security services are investigating the suspected perpetrators with utmost urgency, and that inquiries into the content and scope of the compromised data are being pursued intensively.
Officials for the city-state reported an initial data leak between 7 and 12 August. Then, on 14 August, two department networks were shut down, making applications for housing benefits and payments impossible for several days. Forensic investigations have since revealed further data leaks within Berlin's transport and environment department. The mayor's office stated on Friday that it cannot be ruled out that personal or other non-public data may also be affected.
While authorities have not named the suspected cyber-attackers, Der Spiegel has published a screenshot from the Rhysida group's dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details. The site also displays a countdown, after which it says it will begin auctioning the data with a starting price of 30 bitcoin, the same amount demanded from Berlin.
The Rhysida group has claimed hundreds of attacks since it emerged in 2023, targeting government institutions and businesses in numerous countries. In 2023, it infiltrated the British Museum's computer systems, disrupting services and stealing around 500,000 files. When the museum refused to pay, the group published the files on the dark web. The Berlin cyber-attack comes about a month before the city holds elections, but state senator Iris Spranger insisted that election infrastructure had not been compromised.