The German capital Berlin has been targeted by cybercriminals this month. A BBC News report said a group called Rhysida hacked into the city's state administration network, stole 5.79 terabytes of data and demanded a ransom. Mayor Kai Wegner made it clear that Berlin would not be cowed or give in to demands, despite the group demanding 30 bitcoins - around €2 million.
Attack progress and data leak
The first data breach occurred between August 7 and 12, when cybercriminals accessed the systems of several city departments. Later, on August 14, two parts of the department’s network were shut down, causing temporary disruptions to housing benefit and payment applications. Later stages of forensic investigations revealed additional leaks at Berlin’s transport and environment departments. While the exact content of the stolen data has not yet been disclosed, the mayor’s office warned that personal or other non-public data may have been involved.
Rhysida Group Responsibilities and Requirements
The Rhysida group, which is believed to operate from Russia and Eastern Europe, has been linked to cyber incidents in the past, including the 2023 hack of the British Museum. The group announced on its website that it would start auctioning off the stolen data within seven days, starting at 30 bitcoins, the same amount it is demanding from Berlin. The website also shows a timer after which the data will be sold. This information was confirmed by sources in Reuters and Der Spiegel.
Government response and investigative measures
Mayor Kai Wegner said after a special session in the Rotes Rathaus that the state police, the prosecutor's office and the federal security services are investigating the alleged perpetrators "with the utmost urgency." He stressed that the investigation includes not only the ransom demand, but also an analysis of the content and scope of the data. Berlin also said that the data protection commission and the Federal Office for Information Security (BSI) are being kept informed of the situation.
Impact on the upcoming electoral process
The attack came about a month before the city council election, but state Senator Iris Spranger assured that the election infrastructure was not compromised. She said there was currently no evidence that election data was compromised and that security agencies considered the election environment secure.
International context and cybersecurity recommendations
The Hacker News reports that the US Cybersecurity Agency (CISA) and the FBI have previously warned about the Rhysida group’s „double ransomware“ methodology. They recommend that organizations prioritize addressing known vulnerabilities, implement multi-factor authentication, and segment networks to reduce the risk of ransomware spreading. These recommendations are important not only for Berlin, but also for all countries facing similar threat scenarios.
Conclusions and future prospects
Berlin is currently facing a serious cyber threat, the consequences of which are not yet fully clear. Although the city government refuses to pay the ransom, it is important to monitor how the data analysis process develops and whether more information about the content of the stolen data is revealed. This situation is a reminder that cybersecurity must be constantly strengthened, especially in the public sector, where data confidentiality and service availability are critical.
The impact of the cyberattack shows that both local and international institutions need to work together to quickly identify threats and implement effective protection measures. Berlin, as one of the European capitals, must set an example of how to manage this type of incident responsibly and transparently in order to maintain public trust in institutions.
Sources
- BBC News - Berlin is being blackmailed by hackers, mayor says
- Internet - Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
