Berlin Mayor Declares City Won’t Pay Ransom After Cyberattack

Berlin is being blackmailed by hackers who were able to compromise city systems and steal data earlier this month, its mayor has said.

The incident centres on the Rhysida hacking group—linked to Russia and Eastern Europe—which targeted the German capital’s IT networks. They seized about 5.79 terabytes of data, including personal records, contracts and passwords, and are demanding 30 bitcoin (roughly €2 million) in return for stopping a “data‑sell” slated for a seven‑day countdown.

Mayor Kai Wegner openly rejected the ransom: "Berlin will not be blackmailed." He affirmed that state police, prosecutors and federal security services are working with “great urgency” to map the breach and contain any further damage.

The hack began between 7 and 12 August, when city data was first leaked. By 14 August two municipal networks were shut down, disabling housing‑benefit applications and payment systems for several days. Subsequent forensic work revealed additional leaks in transport and environmental departments, raising the possibility that personal or private data may also have been exposed.

While authorities have not identified the hackers, the Rhysida group’s own website hosts the stolen data and advertises a start‑price auction of 30 bitcoin. Their track record includes a 2023 heist on the British Museum, where they released 500,000 files after the institution refused to pay.

The cyberattack comes just weeks before Berlin’s local elections, prompting city senator Iris Spranger to confirm that election infrastructure remained uncompromised. As investigations continue, residents and officials alike remain on high alert for any further cyber incidents.