The German capital is facing a major digital crisis following a cyberattack orchestrated by the cybercriminal group Rhysida. Between August 7 and 14, the attackers exfiltrated nearly 5.79 terabytes of sensitive data from Berlin’s administrative systems, exploiting an initial phishing vulnerability that went undetected for a week. This massive theft is currently paralyzing essential public services, such as urban planning and mobility management, forcing state departments into a complex remediation process under the guidance of cybersecurity experts.
The operational tactics of the Rhysida collective are marked by an aggressive commercial approach: the stolen data is being auctioned on a dedicated darknet platform. The group is demanding a ransom of 30 bitcoins—approximately 2 million euros—threatening to leak or auction off the confidential information if their terms are not met. The loot reportedly seized by the hackers includes critical data, such as administrative contracts, login credentials, banking details, and blueprints for the city’s strategic infrastructure.
Despite the pressure exerted by this digital ultimatum, Berlin Mayor Kai Wegner’s stance remains firm. Supported by Interior Senator Iris Spranger, he has officially announced that the city refuses to give in to blackmail. This decision aligns with a global trend where public organizations are increasingly avoiding ransom payments, opting instead to rely on law enforcement and cybersecurity specialists. However, the timing is sensitive: the hack occurs just three weeks before regional elections, raising concerns regarding the integrity of the democratic process.
The irony of the situation has not been lost on observers, particularly as Germany recently demonstrated its mastery of digital assets by liquidating a record seizure of 50,000 bitcoins. While the number of ransomware victims continues to rise, the rate of ransom payments is on the decline, now hovering around 28%. By targeting public administrations, which have seen a 56% increase in attacks over the past year, gangs like Rhysida are attempting to offset this drop in profitability by demanding higher sums, turning state institutions into prime targets in the contemporary cybercriminal landscape.