Berlin is facing a serious cyberattack and subsequent extortion attempt, with hackers demanding 30 bitcoin in ransom after stealing terabytes of data from city systems. Mayor Kai Wegner confirmed the city-state will not yield to the blackmailers as investigations intensify ahead of upcoming elections.
The German capital has become the target of a high-stakes extortion scheme after a major network breach compromised municipal systems and exposed sensitive files.
The Cyberattack and Ransom Demands Against Berlin
The cyberattack came to light in mid-August, though the initial data breach occurred between 7 and 12 August, according to municipal authorities. On 14 August, the situation escalated when two department networks were abruptly shut down. The transport department, along with the building and housing department, was temporarily disconnected from the state network.
This technical shutdown caused immediate disruption for residents. All applications for housing benefits and payments were impossible for several days while administrations were cut off from the network.
During a special session of the state government at the Red Town Hall, Mayor Kai Wegner addressed the unfolding crisis. Berlin is the victim of a serious crime, Wegner stated, characterizing the incident as a severe offense against the regional state. The state of Berlin is being blackmailed,
he said.
The extortion demands materialized on Thursday evening. According to reporting from Der Spiegel, which cited confirmation from a security source, the blackmailers demanded 30 bitcoins, equivalent to about two million euros, £1.7m, or $2.5 million.
Kai Wegner, Mayor of Berlin
Wegner emphasized that the state government, known as the Senate, would not comply with the criminals’ demands. Berlin will not be blackmailed,
Wegner said on Friday, adding that Berlin will not give in to blackmail.
Wegner is the outgoing mayor of the capital, which is both a city and a regional state, and is set to step down as Berlin heads to the polls to elect a new state parliament.
The Rhysida Group and the Threat of Data Leaks
Security sources and weekly reports point to the hacker collective known as Rhysida as the primary suspect behind the breach. The group is thought to operate from Russia and eastern Europe, and its tactics carry significant precedent. Rhysida has claimed hundreds of attacks since it emerged in 2023, studies say, and the group has targeted government institutions and businesses of varying sizes in numerous countries. Rhysida previously claimed responsibility for a ransomware attack against the British Library in 2023 and demanded payment of 20 bitcoins—worth some $850,000 at the time—and subsequently published about 500,000 files on the dark web containing the personal data of visitors, subscribers, and staff when the institution refused to pay. The group was also behind a previous attack on the British Museum.
In the Berlin incident, the hackers claimed on their website that they stole 5.79 terabytes of data and intended to begin auctioning it in seven days’ time, according to news agency Reuters. The group established a countdown on its dark web site, after which it said it would begin auctioning off the stolen files with a starting price of 30 bitcoin—the same amount of the cryptocurrency being sought from Berlin, the German newspaper reports. Der Spiegel is carrying a screenshot of the Rhysida group’s dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details.
While authorities initially claimed that no sensitive data had been stolen, officials later walked back those assurances. On Wednesday, authorities admitted that personal data may have been affected. The mayor’s office said in a statement on Friday that forensic investigations had revealed further data leaks within Berlin’s transport and environment department, adding that It cannot be ruled out that personal or other non-public data may also be affected.
Ongoing Investigations and Electoral Security Assurances
The Berlin State Criminal Police Office and the Public Prosecutor’s Office are actively investigating the incident. Federal security services and state police are also involved, working flat-out with prosecutors to investigate the suspected perpetrators with the utmost urgency, and assessing the full scope of the breach.
Authorities in the capital have not named the suspected cyber-attackers in official statements, though Der Spiegel is carrying screenshots of the dark web claims. Inquiries into the content and scope of the compromised data are being pursued with great intensity, and checks were also being made about which data was stolen.
The timing of the cyberattack presents an additional administrative challenge, coming roughly a month before Berlin holds elections on September 20 to elect a new state parliament. One of Berlin’s deputy mayors, state senator Iris Spranger, insisted that election infrastructure had not been compromised. The vote is 100 percent secure,
she added, ensuring that electoral infrastructure remains insulated from the ongoing network crisis.
