Berlin authorities have refused to pay a ransom following a cyberattack on the German capital’s government network that resulted in data being stolen from multiple departments. Ransomware group Rhysida has claimed responsibility and says it obtained 5.79 terabytes of information from city systems.
Berlin Mayor Kai Wegner said the city would not give in to the extortion attempt. In an official statement, the city said state police, prosecutors and federal security agencies were investigating the attack while forensic teams continued examining the affected network.
Data Was Taken Before Systems Were Disconnected
Berlin said investigators had determined that data was removed between August 7 and August 12. Two affected departments, covering mobility, transport, climate and the environment, as well as urban development and housing, were disconnected from the state network on August 14.
Some government services were disrupted following the attack, including applications related to housing benefits and payments. Berlin later restored the affected departments to the network while continuing forensic checks.
The city said in a separate security update that additional data theft had been discovered during the investigation. Authorities have not yet established the full contents of the stolen information and said personal or other non-public data may have been affected.
Rhysida Claims It Will Auction Stolen Data
Rhysida has claimed responsibility for the attack and listed the stolen Berlin data for sale on its dark web site, according to Reuters.
The group claims the files include contracts, emails, phone numbers, passwords and other sensitive information. It has set a starting price of 30 bitcoin and indicated that the auction would begin within days if its demands were not met.
Berlin authorities have not publicly attributed the attack to Rhysida.
The ransomware group has claimed hundreds of attacks since emerging in 2023, with previous targets including government agencies, healthcare organizations and businesses. Rhysida was also responsible for the 2023 attack on the British Library, which disrupted its systems and resulted in stolen data being published after the institution refused to pay a ransom.
Berlin Says Election Systems Were Not Affected
The cyberattack comes ahead of Berlin’s state election on September 20, 2026. Interior Senator Iris Spranger said the election infrastructure had not been compromised and remained technically separated and protected from the affected government systems.
Berlin’s ICT emergency response team remains active while investigators continue scanning the state network and assessing the scale of the breach.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.