In brief
Berlin is facing a cyber‑blackmail after a sophisticated attack compromised city systems, stealing 5.79 terabytes of data. Mayor Kai Wegner vowed the city would not surrender to the 30‑bitcoin ransom and has mobilised police, prosecutors and federal security services. The breach, carried out by the Rhysida group, cut out housing‑benefits and transport services for days, prompting nationwide concern over critical infrastructure security. Authorities are probing the extent of personal data exposed and screening whether electoral systems were affected. The incident highlights the growing threat of state‑level hacking groups targeting municipal networks.
Berlin’s mayor, Kai Wegner, refused to pay a ransom demanded by hackers who stole 5.79 terabytes of data from city servers last month.
The attackers, who identify themselves as the Rhysida group and are believed to be operating from Russia and eastern Europe, threatened to auction the stolen data after a countdown on their dark‑web site. 30 bitcoin—roughly €2 million—was the minimum bid set by the group.
City services were disrupted as several online systems were shut down. Housing‑benefits applications, transport payments, and environment‑department requests were impossible for several days. Forensic work revealed further leaks in Berlin’s transport and environment networks.
According to Berlin officials, the initial breach occurred between 7 and 12 August; the two departmental networks were taken offline on 14 August. State police, prosecutors and federal security services are investigating the incident with “utmost urgency,” and the mayor’s office says it is scrutinising the data’s content and scope.
While the city’s electoral systems were not reported as compromised, the incident comes just a month before Berlin’s municipal elections, heightening alarm over election infrastructure security.
Rhysida has claimed hundreds of attacks since 2023, targeting government institutions and large corporations. The group’s previous high‑profile operation was a breach of the British Museum in 2023, where it stole 500,000 files containing personal data of visitors, subscribers and staff, and later released them on the dark web when a ransom was not paid.
