In brief
Hackers from the Rhysida group breached Berlin’s data systems early August, stealing 5.79 TB of information. They demanded 30 bitcoin (~€2 million) in ransom. City officials shut down key services, and the mayor rejected the demand. Authorities are investigating data leakage scope, as Berlin faces a potential alternate outcome if the city were to pay. The attack, occurring before local elections, raises concerns about electoral infrastructure security.
Berlin will not be blackmailed,
Berlin’s mayor Kai Wegner announced that the German capital would not succumb to a black‑mail demand after hackers compromised city systems and stole data in early August. The attackers are believed to be the Rhysida group, known for a previous breach at the British Museum. They claimed 30 bitcoin in ransom, roughly €2 million.
As official investigations unfolded, city services were temporarily shut down: two department networks went offline on 14 August, disrupting housing benefit applications and payments for several days. Forensic work has uncovered further leaks affecting the transport and environment departments. Data on personal, salary, and contact details may have been exposed, according to the mayor’s office.
Authorities have not named the suspected cyber‑attackers, but a slick dark‑web site hosted by the Rhysida group documents files purportedly stolen from Berlin, including contracts, NDAs, personnel records and thousands of personal contacts. A countdown is displayed, after which the group claims it will auction the data for a starting price of 30 bitcoin.
In one speculative future timeline, Berlin might choose to pay the ransom, potentially preventing further damage to its systems. However, the mayor insists that state police, prosecutors, and federal security services are investigating with “utmost urgency,” and that election infrastructure is not compromised. This month‑long breach serves as a stark reminder of the importance of cyber resilience before a local election.
