Hacker group Rhysida extorts Berlin: 1.44 million files in dark web
Hacker group Rhysida threatens to publish 5.7 terabytes of stolen Berlin administration data – ransom of €2 million was not paid.
Berlin data breach: Rhysida sets ultimatum – Senate refuses payment
At 15:35, the ultimatum expired: the hacker group Rhysida demanded 30 Bitcoin worth approximately 2 million euros to an anonymous account – otherwise it would publish 5.7 terabytes of stolen data from Berlin's Senate administration in the dark web. This is reported by BILD, which gained access to the group's dark web page.
The Senate did not comply with the demand. Governing Mayor Kai Wegner (53, CDU) had previously stated that Berlin would not be extorted.
Data stolen from four Berlin authorities
According to the Senate administration, the data was stolen between 7 and 12 August. The affected networks belong to the Senate administration for mobility, transport, climate protection and the environment, as well as for urban development. Stolen datasets concern citizens, companies and security authorities.
In the dark web, Rhysida presents the stolen contents according to its own claims in a catalogue-like manner for auction. The group claims to possess 1.44 million files – including 46,522 contracts, 5,941 passwords, 16,389 email addresses and 5,000 personnel files.
Constitutional protection documents and LKA investigations allegedly included
Particularly sensitive: Rhysida also claims to possess crisis analyses regarding critical infrastructure, Constitutional Protection office documents, passport and identity card data as well as internal investigation files from the State Criminal Police Office and the state security service.
In the event of non-payment, the hackers comment cynically on their page: "Enjoy that, data hunters." The data would then be made available for download to anyone.
Senate: no indication of continued active infiltration
A spokesman for the Senate chancellery told BILD: "There are currently no findings that the state network is still infiltrated. However, the forensic investigations are ongoing. The investigations are also examining whether additional data may have been leaked." Senate spokeswoman Christine Richter stated that the authorities would respond to further developments.
Group with alleged Russia connections
According to experts, Rhysida is believed to have connections to Russia. The group's name is derived from a venomous millipede from South America – a deliberately chosen metaphor for malware that moves undetected through IT systems.
Rhysida is not limited to major cities: according to BILD, the group also documents attacks on American trade businesses, small-town administrations and medical companies in the dark web. In several cases, ransom is said to have been paid – affected companies are marked on the page with the note "Sold". A total of four auctions are currently running, and 263 companies and administrations are said to have been hacked.
Source: BILD