In the final weeks of summer, Berlin found itself at the intersection of modern statecraft and digital extortion, its municipal systems breached and its citizens' data held hostage by a shadowy ransomware collective. Mayor Kai Wegner's refusal to pay the demanded €2 million mirrors a growing civic philosophy: that capitulation to digital coercion neither restores trust nor guarantees safety. The city's ordeal — disrupted services, exposed personnel files, and an impending dark web auction — reflects the broader vulnerability of democratic institutions to adversaries who operate in the shadows
Berlin refuses ransom demand after hackers steal city data
Thousands of residents unable to apply for housing benefits and payments for several days; personal data of unknown number of individuals potentially compromised.
Berlin will not be blackmailed
Mark
Why does Berlin's refusal to pay matter? Isn't that just the obvious move?
Mimi
It matters because it sets a precedent. If Berlin pays, it signals to every other hacker group that German cities are negotiable targets. But there's a real cost—thousands of people couldn't apply for housing benefits for days.
Luke
Right, and we should be clear: we don't actually know if paying would have stopped the release. The British Museum refused, and Rhysida published anyway. So the calculus isn't as simple as "pay and keep it quiet."
Mark
What do we know about what was actually stolen?
Mimi
Personnel files, contracts, passwords, personal contact details—thousands of them. The transport and environment departments were hit. But the city's own statement says they can't rule out other personal data being compromised.
Luke
That's the honest part of the reporting. They're saying "we don't know yet." That's different from saying "only this was taken." The investigation is ongoing.
Mark
Is Rhysida actually based in Russia?
Mimi
That's what intelligence analysts believe, based on the group's operational patterns and previous activity. But Berlin authorities haven't formally named them—Der Spiegel reported it based on the dark web posting.
Luke
Important distinction. The city hasn't officially confirmed who did this. We know Rhysida claimed it, and the details match their previous work. But attribution in cyber attacks is always probabilistic, not certain.
Mark
What happens if they release the data anyway?
nMimi: Thousands of people's personal information becomes public. It's what happened to the British Museum visitors and staff. Identity theft, fraud, harassment—the usual harms.
Luke
And we don't know how many people are affected. The city said "thousands of personal contact details" were stolen, but the full number of individuals whose data is at risk? Still unknown.
Der Puls
- Between August 7 and 12, hackers silently penetrated Berlin's municipal systems, and by August 14 entire department networks had been shut down, leaving thousands of residents unable to apply for housing benefits or receive payments for days.
- The Rhysida group, suspected of operating from Russia and eastern Europe, claims to have stolen 5.79 terabytes of data — including employment records, passwords, contracts, and thousands of personal contact details — and has set a seven-day countdown before auctioning it on the dark web.
- Mayor Wegner publicly refused to pay the 30-bitcoin ransom, even as the full scope of the breach continues to expand, now touching Berlin's transport and environment departments beyond the initial compromise.
- With city elections weeks away, officials moved swiftly to reassure the public that electoral infrastructure remains secure, while state police, prosecutors, and federal security services investigate with what they describe as utmost urgency.
- Rhysida's track record offers little comfort — when the British Museum refused a similar demand in 2023, the group published half a million stolen files, exposing the personal data of hundreds of thousands of people.
In the final weeks of summer, Berlin found itself at the intersection of modern statecraft and digital extortion, its municipal systems breached and its citizens' data held hostage by a shadowy ransomware collective. Mayor Kai Wegner's refusal to pay the demanded €2 million mirrors a growing civic philosophy: that capitulation to digital coercion neither restores trust nor guarantees safety. The city's ordeal — disrupted services, exposed personnel files, and an impending dark web auction — reflects the broader vulnerability of democratic institutions to adversaries who operate in the shadows between nations.
Berlin's mayor announced Friday that the city would not pay the ransom demanded by hackers who breached municipal systems earlier in August. Mayor Kai Wegner made the declaration after receiving the extortion demand Thursday evening, with Der Spiegel reporting the sum at 30 bitcoin — roughly €2 million. The refusal was firm and public, even as investigators continued to map the full extent of the damage.
The breach unfolded between August 7 and 12, when attackers first gained access to city systems. Days later, two department networks were shut down entirely, leaving residents unable to apply for housing benefits or receive payments for several days. Forensic investigation later revealed the compromise had spread further, reaching data held by Berlin's transport and environment departments. Officials confirmed that personal information and confidential files may have been exposed, though the full picture remains under investigation.
The group claiming responsibility is Rhysida, a ransomware operation believed to be based in Russia and eastern Europe. On its dark web site, the group announced it had stolen 5.79 terabytes of data and would begin auctioning it within seven days. Screenshots showed files including employment records, contracts, non-disclosure agreements, passwords, and thousands of personal contact details. Rhysida has claimed hundreds of attacks since 2023 — most notably breaching the British Museum that year, and publishing roughly 500,000 stolen files after the museum refused to pay.
Wegner's stance echoes that earlier refusal. State police, prosecutors, and federal security services are investigating with what officials called utmost urgency. With Berlin's elections approaching in weeks, State Senator Iris Spranger moved quickly to assure the public that electoral infrastructure had not been affected — a reassurance that itself speaks to how deeply the attack has unsettled civic confidence.
Berlin's mayor announced Friday that the city would refuse to pay a ransom demand made by hackers who had breached municipal computer systems and stolen data earlier in the month. Kai Wegner made the declaration public after receiving the extortion demand Thursday evening, though he did not disclose the amount being sought. According to Der Spiegel, the attackers are asking for 30 bitcoin—approximately €2 million or £1.7 million.
The initial breach occurred between August 7 and 12, when hackers first compromised city systems. A week later, on August 14, two department networks were shut down entirely, rendering it impossible for residents to submit applications for housing benefits or process benefit payments for several days. Forensic investigators subsequently discovered that the breach extended beyond the initial compromise, affecting data held by Berlin's transport and environment departments as well. Officials acknowledged in a statement that personal information and other confidential data may have been exposed, though the full scope remained under investigation.
The group claiming responsibility is Rhysida, a ransomware operation believed to be based in Russia and eastern Europe. According to Reuters, Rhysida announced on its dark web site that it had stolen 5.79 terabytes of data from Berlin and intended to begin auctioning it within seven days. Screenshots of the group's posting, shared by Der Spiegel, showed files including employment records, contracts, non-disclosure agreements, passwords, and thousands of personal contact details. The group set a starting price for the auction at 30 bitcoin—the same amount it was demanding from the city.
Rhysida has claimed responsibility for hundreds of attacks since emerging in 2023, targeting government agencies and businesses across multiple countries. In 2023, the group successfully infiltrated the British Museum's systems, stealing approximately 500,000 files containing visitor, subscriber, and staff data. When the museum refused to pay the ransom, Rhysida published the stolen files on the dark web, exposing the personal information of hundreds of thousands of people.
Wegner's refusal to negotiate mirrors the British Museum's decision three years earlier. State police, prosecutors, and federal security services are investigating the attack with what officials described as utmost urgency, working to determine the full extent of the data theft and identify the perpetrators. The mayor's office emphasized that inquiries into the content and scope of the compromised information were being pursued with great intensity.
The timing of the breach—roughly a month before Berlin holds elections—raised immediate questions about the security of the electoral process itself. State senator Iris Spranger moved quickly to assure the public that election infrastructure had not been compromised by the attack. The incident underscores the vulnerability of major municipal systems to sophisticated cyber operations and the difficult position cities face when confronted with demands to pay for the return of stolen data, knowing that payment offers no guarantee the information will not be released or sold regardless.
Bemerkenswerte Zitate
Berlin will not be blackmailed— Mayor Kai Wegner
It cannot be ruled out that personal or other non-public data may also be affected— Berlin mayor's office statement
Möchten Sie die ganze Geschichte?
Das Original lesen bei BBC News ↗
War & Conflict