Berlin is currently facing a significant cyberattack, with hackers claiming responsibility for compromising city systems and stealing sensitive data, according to statements made by the city’s mayor, Kai Wegner.
Wegner confirmed that his administration would not succumb to the ransom demands issued by the attackers on Thursday evening. While the specific amount was not disclosed by officials, Der Spiegel reports that the hackers are seeking 30 bitcoin, approximately valued at €2 million (£1.7 million).
The cyberattack forced the temporary shutdown of several of the German capital’s online services as authorities scrambled to assess the extent of the breach and identify the stolen information.
According to Reuters, the Rhysida group—believed to operate from Russia and Eastern Europe and previously responsible for an attack on the British Museum—has taken credit for the incident.
In a statement on its dark web platform, the group announced plans to auction off 5.79 terabytes of data allegedly extracted from Berlin’s systems within seven days, with a starting bid of 30 bitcoin, as reported by news agencies.
“Berlin will not be blackmailed,” Wegner declared firmly on Friday, emphasizing that state police, prosecutors, and federal security services are investigating the matter with “utmost urgency.” He added that inquiries into both the content and scope of the compromised data are ongoing and being pursued “with great intensity.”
City officials confirmed that initial unauthorized access occurred between August 7 and 12. Subsequently, on August 14, two departmental networks were taken offline, disrupting applications for housing benefits and payments for several days.
Further forensic analysis has revealed additional data leaks within Berlin’s departments of transportation and environment, prompting concerns over potential exposure of personal and non-public records.
“It cannot be ruled out that personal or other non-public data may also be affected,” the mayor’s office warned in a formal statement released on Friday.
While authorities have not officially attributed the attack to any specific group, Der Spiegel published screenshots from what appears to be the Rhysida collective’s dark-web portal. The group claims possession of contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details.
The hackers have also posted a countdown timer indicating when they plan to initiate auctions for the stolen data—a bid matching the 30-bitcoin ransom demand made to Berlin, according to the German publication.
Rhysida has been linked to numerous high-profile cyberattacks since emerging in 2023, targeting government institutions and private enterprises across various countries.
In 2023, the group infiltrated the British Museum’s network, exfiltrating around 500,000 files before leaking them on the dark web after the institution refused to pay the ransom. The leaked material included personal data belonging to visitors, subscribers, and employees.
This latest attack occurs just weeks ahead of upcoming elections in Berlin, though State Senator Iris Spranger assured the public that electoral infrastructure remains untouched and secure.
