Berlin hit by ransomware attack, hackers demand bitcoin payment

Berlin's Mayor Kai Wegner has confirmed that the German capital's administration is being blackmailed by hackers after attackers broke into city computer systems and stole data earlier this month. A ransom demand arrived on Thursday evening, but Wegner said Berlin would not give in to the extortion attempt. He did not disclose the exact sum being demanded, though newspaper Der Spiegel reports the hackers are asking for 30 bitcoin, worth roughly €2m.

The attack forced some of the city's online systems offline. An initial data leak is believed to have occurred between 7 and 12 August, and on 14 August two departmental networks were shut down, halting applications for housing benefits and related payments for several days. Subsequent forensic investigation uncovered further leaks affecting the city's transport and environment departments. Officials said they cannot rule out that personal or other non-public data has been compromised.

The Rhysida group, believed to operate out of Russia and eastern Europe, has claimed responsibility. It says it plans to auction off the 5.79 terabytes of data stolen from Berlin within seven days, including contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact records. The starting price for the auction is reportedly the same 30 bitcoin being demanded from the city.

State police, prosecutors and federal security services are investigating the suspected perpetrators, with authorities examining the scope and content of the compromised data. Rhysida has claimed responsibility for hundreds of attacks since emerging in 2023, targeting government bodies and businesses of various sizes worldwide. It previously breached the British Museum in 2023, publishing around 500,000 stolen files after the museum refused to pay a ransom. The Berlin attack comes about a month before the city's elections, though state senator Iris Spranger said election infrastructure had not been affected.