Berlin’s mayor, Kai Wegner, refused to pay a ransom demanded by hackers who stole 5.79 terabytes of data from city servers last month.
The attackers, who identify themselves as the Rhysida group and are believed to be operating from Russia and eastern Europe, threatened to auction the stolen data after a countdown on their dark‑web site. 30 bitcoin—roughly €2 million—was the minimum bid set by the group.
City services were disrupted as several online systems were shut down. Housing‑benefits applications, transport payments, and environment‑department requests were impossible for several days. Forensic work revealed further leaks in Berlin’s transport and environment networks.
According to Berlin officials, the initial breach occurred between 7 and 12 August; the two departmental networks were taken offline on 14 August. State police, prosecutors and federal security services are investigating the incident with “utmost urgency,” and the mayor’s office says it is scrutinising the data’s content and scope.
While the city’s electoral systems were not reported as compromised, the incident comes just a month before Berlin’s municipal elections, heightening alarm over election infrastructure security.
Rhysida has claimed hundreds of attacks since 2023, targeting government institutions and large corporations. The group’s previous high‑profile operation was a breach of the British Museum in 2023, where it stole 500,000 files containing personal data of visitors, subscribers and staff, and later released them on the dark web when a ransom was not paid.
