Berlin refuses ransom after hackers claim theft of city data

Berlin will not pay a ransom after a cyberattack that breached city networks earlier this month. The Rhysida ransomware group claims responsibility and posted that it copied more than 5.7 terabytes of files.

Officials discovered the incident on Aug. 14 and took the networks of the Senate Department for Mobility, Transport, Climate Protection and Environment and the Senate Department for Urban Development, Construction and Housing offline to contain the breach. Authorities say the data removal likely occurred between Aug. 7 and Aug. 12.

Rhysida published a list of material it says it took, including complaints and legal documents, financial records, contracts, human resources files, passwords, payment details such as IBANs, lawsuit files, payroll records, passport and ID information, and private material related to city leadership. The group said the haul included personal details for more than 12,000 people, over 16,000 email addresses and nearly 12,000 phone numbers.

The attackers demanded 30 bitcoin, roughly $2.3 million. Governing Mayor Kai Wegner and Interior Senator Iris Spranger confirmed the ransom demand and stated the city would not pay.

Berlin has limited public comment while state criminal police, federal security agencies and the public prosecutor’s office investigate. Officials have not released further details about the full scope of the breach, which specific systems were affected, or whether stolen data has been published.

Authorities did not give a timetable for restoring full network operations at the affected departments. The shutdown, implemented on Aug. 14, affected internal departmental systems as a containment measure.

The case remains under investigation. City officials said they will provide more information as inquiries progress and as authorities assess any risks to residents and municipal services.