Image credit: Shutterstock
Berlin authorities are investigating a cyberattack on the city-state’s administrative network after hackers reportedly demanded 30 Bitcoin, worth about €2 million, and threatened to publish stolen government data.
Berlin has refused to pay. Officials confirmed that data left government systems between August 7 and 12, but they have not verified the attackers’ claims about the volume or contents of the stolen files.
Rhysida Claims it Stole 5.79 TB From Berlin Systems
Ransomware group Rhysida has claimed responsibility for the attack and says it obtained 5.79 terabytes of data from Berlin government systems.
The group reportedly listed the material for 30 BTC and threatened to release it if its demand was not met. Reports based on the dark web listing say the files include contracts, emails, passwords, and login information.
Berlin has not confirmed Rhysida as the attacker or verified those claims. Forensic teams are still determining which files were accessed and whether personal or other non-public information was taken.
Two Senate Departments Were Disconnected on August 14
The attack affected Berlin’s Senate Department for Mobility, Transport, Climate Protection and Environment and its Senate Department for Urban Development, Building and Housing.
Both departments were disconnected from the state network on August 14 while authorities contained the intrusion. They were reconnected over the following weekend after emergency security measures were introduced.
Investigators later identified additional data outflows involving the mobility department. Berlin’s State Criminal Police Office, public prosecutor and federal security authorities are investigating the incident.
Berlin Refuses 30 BTC Demand as Forensic Investigation Continues
Governing Mayor Kai Wegner said Berlin would not meet the extortion demand, while the city’s ICT emergency response team continues scanning the network and assessing the stolen data.
The attack comes ahead of Berlin’s September 20 House of Representatives election. Authorities said election infrastructure is separate from the affected systems and has not been compromised.
Interior Senator Iris Spranger said no election data is known to have been taken. Investigators are still determining whether Rhysida’s 5.79 TB claim is accurate and what information was exposed.
