Berlin's mayor states city won't pay hackers' ransom demand

Berlin's Mayor, Kai Wegner, announced that the German capital would not accede to the demand for a ransom.

Berlin's Mayor, Kai Wegner, is pictured speaking into a microphone, dressed in a dark suit with a blue tie, against a pale yellow background.

According to Berlin's Mayor, the city is currently under extortion by hackers who successfully breached its computer systems and stole information earlier this month.

Kai Wegner stated that city officials would not submit to the ransom request, which arrived on Thursday evening. He did not disclose the precise amount sought, although Der Spiegel reports that the hackers are asking for 30 bitcoin, an amount equivalent to approximately €2 million (or £1.7 million).

The cyber-attack necessitated the shutdown of some of the German capital's online services, while investigators commenced work to ascertain the extent of the data theft.

The Rhysida group, believed to operate from Russia and Eastern Europe and known for a previous assault on the British Museum, has reportedly claimed responsibility for the incident.

The group has declared on its website its intention to commence an auction of the 5.79 terabytes of data stolen from Berlin in seven days, as reported by Reuters.

He affirmed that state police, prosecutors, and federal security agencies were diligently working to identify the suspected culprits, emphasizing that investigations into the nature and volume of the compromised data were being pursued with great urgency.

City-state officials confirmed that an initial data breach took place between August 7 and August 12.

Subsequently, on August 14, two departmental networks were taken offline, rendering housing benefit applications and payments impossible for several days.

Officials later revealed that forensic examinations had uncovered additional data compromises within Berlin's transport and environment departments.

The Mayor's office issued a statement on Friday, indicating that it could not be ruled out that personal or other confidential information might have been affected.

While authorities in the capital have refrained from naming the alleged cyber-attackers, Der Spiegel has published a screenshot from the Rhysida group's dark web site, purporting to show files containing contracts, non-disclosure agreements, personnel records, passwords, and thousands of personal contact details.

The website also features a countdown timer, after which it claims it will begin auctioning the data, with a starting bid of 30 bitcoin – the same cryptocurrency sum demanded from Berlin, according to the German newspaper.

Studies indicate that the Rhysida group has asserted responsibility for hundreds of attacks since its emergence in 2023, targeting government bodies and various sizes of businesses across numerous countries.

In 2023, it successfully penetrated the British Museum's computer systems, disrupting services and acquiring around 500,000 files.

When the UK institution declined to pay the ransom, the group proceeded to publish the files, which included personal data belonging to visitors, subscribers, and staff, on the dark web.

The cyber-attack in Berlin occurs roughly one month before the city's elections, although state senator Iris Spranger assured that the electoral infrastructure remained secure.