Berlin’s mayor Kai Wegner has stated that the German capital will not give in to a ransom demand following a hacking incident that revealed a massive data breach of city systems earlier this month. The attackers are believed to belong to the Rhysida group, known for targeting government institutions and private companies across Europe.
The hackers requested 30 bitcoin – worth approximately €2 million – and threatened to auction 5.79 terabytes of stolen data within a week. The city’s security forces are responding with force: state police, prosecutors and federal agencies have begun a rapid investigation into the breach, the content of stolen files and the possible impact on personal data of city residents.
During the attack, some Berlin online services were shut down, preventing citizens from accessing housing benefits and wage payments for several days. The incident began between the 7th and 12th of August, and on the 14th the city shut down two departmental networks to limit further damage.
City officials are assessing whether personal or other sensitive data was compromised, noting that the Rhysida group has a history of publishing stolen data as a threat, exemplified by their prior attack on the British Museum in 2023. The group released a dark‑web site posting thousands of personal contact details and files, then threatened to auction the data if the museum did not meet the ransom.
Berlin's mayor emphasized that the city would not be blackmailed and that election infrastructure, scheduled for upcoming local elections, had remained intact. The city’s response underscores the growing need for robust cyber‑defence measures to protect public institutions from extortion and data theft.
