Berlin’s mayor Kai Wegner declared the city would not surrender to a ransomware demand targeting its municipal networks.
The attackers, affiliated with the Rhysida group—believed to operate from Russia and Eastern Europe—stole an estimated 5.79 terabytes of data and are offering it for auction in a week. 30 bitcoin, roughly €2 million, has been requested as ransom.
During the breach, several city systems, including housing benefit applications and transport services, were forced offline, disrupting public services for days.
State police, prosecutors and federal security agencies are collaborating to investigate the compromise, with forensic teams analysing the scope of stolen personal information.
Officials have confirmed that the initial data leak began between 7 and 12 August, followed by the shutdown of two department networks on 14 August. Subsequent investigations uncovered further leaks in Berlin’s transport and environment departments.
The mayor’s office cautions that private personal data may have been affected, but asserts that election infrastructure remains intact amid a looming local election.
This incident echoes the Rhysida group’s 2023 attack on the British Museum, which saw the theft of over 500,000 files and the exposure of visitor and staff personal data.
