Hacker group Rhysida's ultimatum has expired - data may be published on the darknet

Berlin. In the blackmail case following the massive data theft in the Berlin state network, the criminal hacker group Rhysida's ultimatum has expired. It was initially unclear immediately after the deadline expired on Friday afternoon whether the perpetrators carried out their threat and published the approximately 5.8 terabyte data package on the darknet.

The blackmailers had set up a countdown on their leak site that expired on Friday at around 3:35 p.m. A ransom of 30 Bitcoin (the equivalent of around two million euros) was demanded. The Berlin Senate had previously confirmed that it would not respond to such blackmail and would not pay a ransom. After the deadline had passed, the “auction” was ended on the blackmailers’ website in the Darknet. “All files have been uploaded to the publicly accessible area - have fun browsing, data hunters!” it said. However, a link did not lead to the data, but rather an error message.

The Senate's refusal to respond to blackmail attempts by criminal hackers was met with approval among experts. Bianca Kastl from the Chaos Computer Club said on RBB Inforadio that the Senate's decision was correct. “If you continued to support these groups with money or other things, then of course they would keep going,” she said. “You have to dry them out financially.”

The renowned IT security expert Christof Fischer pointed out that by law the state is not allowed to make payments in the event of extortion. However, the situation with incidents like those in Berlin is very difficult: "The data is in the hands of criminals, and publication in many cases has very damaging effects. So far, I have not come across any case in which payment was made and publication still took place." However, it can be assumed that the perpetrators, who mostly lived in Eastern European countries, made this data available to the authorities there in order to buy protection from investigations against themselves, Fischer told the dpa.

The listings and screenshots previously published by the attackers indicate a serious outflow of highly sensitive data. The group claims to have stolen around 1.44 million files. In addition to more than 5,000 personnel files, fines and pay slips, this also includes confidential documents from Federal Council committees and vulnerability analyzes of Berlin's drinking water supply.

The Berlin administration confirmed the cyber attack that became known on August 14th. Investigators from the State Criminal Police Office (LKA) and the Federal Office for Information Security (BSI) are involved in analyzing and dealing with the incident. If the data package becomes fully public, the authorities concerned and thousands of citizens and employees face significant data protection and security risks.