Cyber attack on Berlin: Rhysida hackers publish over one million stolen records
The Rhysida ransomware group has published over one million sensitive records from Berlin's administration on the darknet after Mayor Kai Wegner refused to pay a ransom of 2 million euros.
Berlin, target of massive cyber attack: administration data published on darknet
Berlin's Mayor Kai Wegner has confirmed that the city's administration lost sensitive data following a cyber attack on 14 August, according to ProTV News, citing the AFP news agency. Wegner stated that he wishes to contact those affected "as soon as possible".
The regional public audiovisual group RBB reported that hackers published on Friday over one million records stolen from Berlin's administration on the darknet, after the administration refused to pay the demanded ransom.
Who are the attackers and what data was compromised
German press identifies the ransomware group Rhysida as responsible, which reportedly demanded a sum equivalent to approximately 2 million euros. Wegner rejected the extortion in an interview with the newspaper "Bild": "Who can say that, even if we had paid, these records would not already have been elsewhere for a long time?"
The weekly Der Spiegel detailed the types of information targeted: protective measures against risks within Berlin's fire service, salary lists, bank data, scans of identity documents, disciplinary files and accusations of professional negligence against certain employees, as well as files related to the expansion of the German Chancellery.
Precedent: Rhysida had already attacked the British Library
Rhysida is not at its first incident of this kind. The group claimed responsibility for the attack on the British Library in London in autumn 2023, demanding a ransom equivalent to over 760,000 euros. The library refused to pay, and hackers later published approximately 500,000 files with personal data of visitors, subscribers and library staff on the dark web.
Operational impact on Berlin
The attack on 14 August significantly disrupted municipal services. Several departments — particularly those responsible for housing and the environment — were disconnected from the network for a week. Requests for housing allowances and related payments were blocked for several days.
The incident occurred one month before municipal elections on 20 September, although authorities did not question whether the ballot would go ahead.
Investigation and crisis unit
The Berlin government announced on Saturday the establishment of a central crisis unit that will coordinate the analysis, verification and assessment of the massive volume of published data, whilst also supporting the notification of affected citizens and businesses.
Authorities described the incident as "an extremely serious crime" and an attack on the state, urging the public not to spread unverified claims on social media. Those affected by the data breach will be notified by the competent authorities, in accordance with German and European data protection regulations.
Source: Știrile ProTV