Berlin’s mayor, Kai Wegner, declared the city will not negotiate with the Rhysida hacking collective after it demanded a ransom of 30 bitcoin – roughly €2 million – for stolen data accessed in August.
The group, believed to operate from Russia and eastern Europe, has recorded the theft of 5.79 terabytes of Berlin’s confidential data, including personal records, contracts and passwords. Wedger's statement stressed that state police, prosecutors and federal security services are working with urgency to pinpoint the perpetrators and assess the breach’s scope.
Earlier this month, two department networks were shut down, disrupting housing benefits and payment applications for several days. Forensic analysis later revealed further leaks in the transport and environment departments, raising the possibility that private citizen information may have been compromised.
A screenshot published by Der Spiegel shows Rhysida’s dark‑web site boasting the data dump and advertising a countdown until the files are offered for auction at 30 bitcoin. The attackers have previously targeted other institutions, most notably the British Museum in 2023, where they released stolen visitor and staff data after the UK institution refused to pay.
The breach came just a month before Berlin’s local elections, though state senator Iris Spranger has insisted that electoral infrastructure remains secure.
Key Facts
- Ransom demand: 30 bitcoin (~€2 million)
- Data volume: 5.79 TB
- Systems impacted: housing, transport, environment
- Source of hacking: Rhysida (Russia/eastern Europe)
- Investigation by: state police, prosecutors, federal security services
