Cyber attack on Berlin: over one million records stolen, published on darknet by Rhysida group
Berlin Mayor Kai Wegner has confirmed the theft of sensitive data from the city administration, refusing to pay the €2 million ransom demanded by hackers.
Berlin under cyber siege: data belonging to over one million people exposed on darknet
Berlin Mayor Kai Wegner confirmed that sensitive data from the city administration was stolen following a cyber attack on 14 August, according to News.ro citing AFP. Wegner stated that he wishes to contact affected persons "as soon as possible".
According to German weekly Der Spiegel, the compromised data includes internal security measures of Berlin's fire brigade, salary lists, banking information, identity document scans and confidential personnel files — including allegations of professional negligence and disciplinary cases. Documents relating to the expansion of the German Chancellery were also targeted.
Hackers published data after ransom refusal
German public broadcasting company RBB reported that the hackers published over one million stolen records from Berlin administration on darknet on Friday, after the administration refused to pay the requested sum. Wegner explained in an interview with newspaper Bild the reason for refusing: "Who can say that, even if we had paid, this data would not have ended up elsewhere long ago?"
German media identify the ransomware group Rhysida as the author of the attack, which allegedly demanded the equivalent of approximately €2 million. The same group claimed responsibility for the attack on the British Library in London in autumn 2023, requesting a ransom of over €760,000 at that time. The library refused payment, and Rhysida subsequently published approximately 500,000 files containing personal data of visitors, subscribers and employees on the dark web.
Public services blocked for one week
The 14 August attack led to the disconnection from the network of several city departments, particularly those responsible for housing and the environment. Housing allowance requests and associated payments were impossible to process for several days.
The incident occurred approximately one month before municipal elections on 20 September, which were held without being affected by the attack.
Central crisis unit and notification of citizens
Berlin's government announced on Saturday that it is analysing the massive volume of data published by the ransomware group, whilst investigators assess the scope and impact of the attack, which targeted two departments of the administration. A central crisis unit will coordinate the analysis, verification and evaluation of the leaked data and will support the notification of affected citizens and companies.
The authorities have characterised the incident as "an extremely serious crime" and an attack on the state itself, urging the public not to spread unverified claims on social networks. Affected persons will be notified by the competent authorities, in accordance with German and European data protection regulations.
Source: News.ro