The German capital is grappling with a major cybersecurity crisis following a sophisticated digital intrusion orchestrated by the cybercriminal group Rhysida. This entity, suspected of operating from Eastern Europe, reportedly managed to exfiltrate nearly 5.79 terabytes of sensitive data, including contractual documents, administrative files, and personal information concerning municipal staff. The incident forced authorities to isolate several departmental networks, temporarily paralyzing essential public services, such as access to housing assistance.
The attackers' modus operandi relies on direct financial pressure: a ransom demand set at 30 BTC, equivalent to approximately two million euros. The hackers issued a seven-day ultimatum, threatening to auction the entirety of the stolen data on the dark web should payment not be received. In response, the Mayor of Berlin was unequivocal, stating that the city categorically refuses to yield to extortion, while mobilizing federal security forces and intelligence services to resolve the matter.
The choice of Bitcoin as a transaction vector once again highlights the central role the cryptocurrency plays in the underground ransomware economy. Despite the transparent and immutable nature of the blockchain, BTC remains favored by these groups for its international liquidity and the relative ease with which funds can be moved or obscured. While the amount demanded may seem modest compared to record-breaking attacks in recent years, the symbolic and operational impact on a public administration remains significant.
This episode sheds light on the growing vulnerability of public institutions to actors specialized in digital extortion. Rhysida, identified as an active threat since 2023, has already made headlines for large-scale cyberattacks, notably against the British Museum. As the investigation into the exact extent of the leak continues, Berlin authorities have sought to reassure the public: infrastructure related to electoral processes remains, to date, entirely secure. This affair underscores the critical challenge of cybersecurity in managing citizen data in the digital age.