In brief
Berlin’s mayor Kai Wegner announced the city would not capitulate to the recent ransomware threat demanding 30 bitcoin (≈€2 m). Hackers from the Rhysida group breached multiple municipal systems, causing service outages and exposing personal data. Authorities are probing the extent of the data loss, with forensic teams examining transports, environment, and housing departments. Berlin’s election cycle adds urgency, yet officials assure electoral infrastructure remains secure. The breach underscores the growing threat of state‑sponsored cyber‑crime targeting European capitals.
Berlin’s mayor Kai Wegner declared the city would not surrender to a ransomware demand targeting its municipal networks.
The attackers, affiliated with the Rhysida group—believed to operate from Russia and Eastern Europe—stole an estimated 5.79 terabytes of data and are offering it for auction in a week. 30 bitcoin, roughly €2 million, has been requested as ransom.
During the breach, several city systems, including housing benefit applications and transport services, were forced offline, disrupting public services for days.
State police, prosecutors and federal security agencies are collaborating to investigate the compromise, with forensic teams analysing the scope of stolen personal information.
Officials have confirmed that the initial data leak began between 7 and 12 August, followed by the shutdown of two department networks on 14 August. Subsequent investigations uncovered further leaks in Berlin’s transport and environment departments.
The mayor’s office cautions that private personal data may have been affected, but asserts that election infrastructure remains intact amid a looming local election.
This incident echoes the Rhysida group’s 2023 attack on the British Museum, which saw the theft of over 500,000 files and the exposure of visitor and staff personal data.
