Berlin is facing a ransomware attack after hackers compromised city systems, stole data and demanded payment. Mayor Kai Wegner said the German capital would not give in to the blackmail attempt.
What are the hackers demanding from Berlin?
The ransom demand emerged on Thursday evening. Wegner did not disclose the amount being sought, but German newspaper Der Spiegel reported that the hackers were demanding 30 bitcoin, worth around €2 million (£1.7 million).
“Berlin will not be blackmailed,” Wegner said on Friday.
The Rhysida ransomware group, which is thought to operate from Russia and eastern Europe, has reportedly claimed responsibility for the attack.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
The group said it intends to begin auctioning 5.79 terabytes of data allegedly stolen from Berlin in seven days, according to Reuters.
What data and city services were affected?
Some of Berlin’s online systems were forced to shut down following the cyberattack.
Officials said an initial data leak occurred between August 7 and 12. On August 14, two department networks were shut down, making applications for housing benefits and payments unavailable for several days.
Forensic investigations later identified further data leaks involving Berlin’s transport and environment department.
The mayor’s office said it could not be ruled out that personal or other non-public information may also have been affected.
Authorities have not publicly named the suspected attackers. However, Der Spiegel reported that the Rhysida group’s dark web site claimed to possess files including contracts, non-disclosure agreements, personnel records, passwords and thousands of personal contact details.
The site was also reportedly displaying a countdown to an auction of the stolen information, with a starting price of 30 bitcoin.
How is Berlin responding to the ransomware attack?
State police, prosecutors and federal security services are investigating the suspected cyberattack with “the utmost urgency”, according to Wegner.
Investigators are working to establish the content and extent of the compromised information.
Rhysida has claimed hundreds of attacks since emerging in 2023, targeting government institutions and businesses in several countries.
The group previously infiltrated the British Museum’s computer systems in 2023, disrupting services and stealing around 500,000 files. After the institution refused to pay the ransom, the group published files containing personal information belonging to visitors, subscribers and staff on the dark web.
The Berlin attack comes roughly a month before the city holds elections. State senator Iris Spranger said the election infrastructure had not been compromised.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
