Berlin says it won’t pay ransom after hackers steal government data

Berlin has refused to pay a ransom demanded by hackers who allegedly stole data from the region’s government network, officials said.

Governing Mayor Kai Wegner said on Friday that Berlin had received an extortion demand following the cyberattack, which was discovered in mid-August.

“The state of Berlin is being blackmailed,” Wegner said, adding that the government would not comply with the attackers’ demands.

His comments came as the Rhysida ransomware group claimed responsibility for the attack, adding Berlin to its dark-web leak site and claiming to have stolen 5.79 terabytes of government data, according to several dark-web monitoring websites.

The group said the stolen material included 46,500 contracts, as well as emails, telephone numbers, passwords and classified information. Rhysida advertised the dataset for auction with a starting price of 30 bitcoin ($2.3 million) and posted a countdown of roughly seven days.

Berlin authorities have confirmed that data was stolen and that the government received an extortion demand, but they have not publicly attributed the attack to Rhysida or verified the group’s claims about the volume or contents of the stolen information.

Authorities are still investigating the scope and contents of the stolen data and said they could not rule out that personal data or other non-public information was compromised. The data is believed to have been taken between Aug. 7 and Aug. 12. Wegner previously said there was no indication that sensitive information had been compromised.

Berlin disconnected the affected systems from the wider state network on Aug. 14 after discovering the breach. Two ministries — one responsible for urban development, construction and housing and another overseeing mobility, transport, climate protection and the environment — were cut off.

Both remained operational, but employees lost access to their usual IT systems, including email and internet services, forcing some staff to communicate by telephone, text message and fax.

The disruption also affected other public services. Some district offices were temporarily unable to process applications for housing benefits and education and participation assistance because they rely on systems operated by the affected urban development ministry.

Berlin’s state-owned IT provider, ITDZ Berlin, was not affected. The two ministries share some IT infrastructure and operate their section of the state network independently of ITDZ, according to local media reports.

The breach comes less than a month before Berlin holds elections to its House of Representatives on Sept. 20, raising concerns about whether the attackers could disrupt election infrastructure.

Interior Senator Iris Spranger said Friday that election systems were protected against an attack similar to the one that hit the ministries.

“According to what we know at this point, no data has been exfiltrated from there,” Spranger said. “According to our security officials, the election environment is secure.”

Rhysida has operated since at least May 2023, targeting governments, hospitals, schools, manufacturers and technology companies. The financially motivated ransomware operation typically steals victims’ data and encrypts their systems before demanding cryptocurrency payments.

The group has targeted a string of high-profile public-sector and health care organizations around the world. Cybersecurity researchers have previously assessed that the group is likely Russian-speaking or operating from the broader Russian region, though its operators’ identities and precise location remain unclear.