Berlin mayor says city will not pay ransom after Rhysida hackers steal data

Berlin is being blackmailed by hackers who were able to compromise city systems and steal data earlier this month, its mayor has said.

Kai Wegner said officials would not cave in to the ransom demand, which came on Thursday evening. He did not say how much was being sought, though Der Spiegel reports the hackers are demanding 30 bitcoin, worth around €2m (£1.7m).

Some of the German capital's online systems were forced to close down as a result of the attack, while investigators were working to understand what data had been taken.

The Rhysida group, which is thought to operate from Russia and eastern Europe, and was behind a previous attack on the British Museum, has reportedly taken responsibility.

It has said on its website it intends to begin auctioning the 5.79 terabytes of data it was able to steal from Berlin in seven days' time, according to news agency Reuters.

"Berlin will not be blackmailed," Wegner said on Friday.

He said state police, prosecutors and federal security services were working to investigate the suspected perpetrators "with the utmost urgency", adding that inquiries into the "content and scope of the compromised data are being pursued with great intensity".

Officials for the city-state said an initial data leak occurred between 7 and 12 August.

Then, on 14 August, two department networks were shut down, making applications for housing benefits and payments impossible for several days.

Forensic investigations had since revealed further data leaks within Berlin's transport and environment department, officials said.

"It cannot be ruled out that personal or other non-public data may also be affected," the mayor's office said in a statement on Friday.

Authorities in the capital have not named the suspected cyber-attackers, though Der Spiegel is carrying a screenshot of the Rhysida group's dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details.

It is also displaying a countdown, after which it says it will begin auctioning off the data with a starting price of 30 bitcoin - the same amount of the cryptocurrency being sought from Berlin, the German newspaper reports.

The Rhysida group has claimed hundreds of attacks since it emerged in 2023, studies say, and the group has targeted government insititutions and businesses of varying sizes in numerous countries.

It successfully infiltrated the British Museum's computer systems in 2023, disrupting services and stealing around 500,000 files.

When the UK institution refused to pay the ransom, the group published the files - containing the personal data of visitors, subscribers and staff - on the dark web.

The Berlin cyber-attack comes roughly a month before the city holds elections, though state senator Iris Spranger insisted that election infrastructure had not been compromised.