The mayor of Berlin refuses to pay a €2 million ransom to hackers

Berlin Mayor Kai Wegner announced on Friday that the German capital was the target of cyber blackmail following a breach of its computer systems in early August. The city is refusing to give in to the hackers' demands.

"Berlin will not be blackmailed." With these words, Berlin Mayor Kai Wegner responded on Friday to the ransom demand sent the previous day by a group of hackers who had compromised the city's computer systems. According to Der Spiegel magazine, the hackers are demanding 30 bitcoins, or approximately 2 million euros.

The initial intrusion dates back to the beginning of the month: a first data leak was detected between August 7 and 12. On August 14, two departmental networks were taken offline, making it impossible for several days to process housing benefit applications and pay out certain social benefits. Forensic investigations have since revealed other leaks within the city's transportation and environment department.

The mayor's office has not ruled out the possibility that personal data or other non-public information has been compromised. The state police, the public prosecutor's office, and the federal security services have been notified and are working, according to Wegner, "with the utmost urgency" to identify the perpetrators and assess the extent of the stolen data.

The Rhysida group, suspected of operating from Russia and Eastern Europe, has reportedly claimed responsibility for the attack on its dark web site. The organization claims to possess 5,79 terabytes of data from the Berlin systems, including contracts, confidentiality agreements, personnel files, passwords, and thousands of personal contact details. A countdown timer is displayed on the site: when it expires, the data will be auctioned starting at 30 bitcoins.

Rhysida has been active since 2023 and has claimed responsibility for hundreds of attacks against government institutions and businesses in numerous countries. The group notably infiltrated the British Museum's systems that same year, stealing some 500,000 files. When the British institution refused to pay, the data (containing personal information of visitors, subscribers, and staff) was published on the dark web.

The attack comes less than a month before the municipal elections in Berlin. Senator Iris Spranger, in charge of the interior, was quick to clarify that the electoral infrastructure had not been affected.