Hackers claiming responsibility for a breach of Berlin's government systems are demanding 30 bitcoin, worth roughly $1.2 million at current prices, after stealing sensitive data ahead of the city's September election.
The Rhysida group announced the theft on its leak site August 28, disclosing 5.79 terabytes of data including over 46,500 government contracts. The group set a seven-day deadline for payment before the data would be auctioned to third parties, according to the disclosure.
Berlin's Mayor Kai Wegner and Interior Senator Iris Spranger rejected the demand in a joint statement, saying the city would not submit to extortion. The breach occurred weeks before a state election scheduled for late September.
Rhysida has been active since at least 2023, according to cybersecurity tracking. The group operates a ransomware-as-a-service model, licensing its encryption tools to affiliates who conduct attacks and split proceeds with the core team. Berlin is among the largest government targets the group has publicly claimed.
The 5.79TB dataset substantially exceeds the typical government breach by volume. The 2020 SolarWinds supply-chain attack, which compromised multiple U.S. federal agencies, involved exfiltration of source code rather than complete document archives. The scale here indicates the attackers gained sustained access to Berlin's internal file systems rather than a single service.
German federal cybersecurity authorities, the BSI, have opened an investigation. Law enforcement has not yet confirmed whether the stolen data contains classified information or materials related to ongoing security operations.
The demand of 30 bitcoin is substantially lower than ransom requests typical of attacks on large municipal systems in the United States and Western Europe, which have averaged between 50 and 200 bitcoin in recent years. Attackers may have priced the demand based on Berlin's assessed capacity to pay or as a tactic to increase the likelihood of settlement before the auction threat materializes.
