Berlin Won’t Pay Extortion Group Claiming Data Theft
Berlin’s city government has refused to pay a ransom to a ransomware group, Rhysida, who claimed responsibility for stealing a massive amount of sensitive data from city networks. The group, allegedly linked to the Rhysida ransomware gang, demanded 30 Bitcoin (~$2.3 million) for the stolen information, including personal details of over 12,000 residents and extensive confidential documents.
Berlin’s city government announced on Friday that it would not pay a ransom to Rhysida, a ransomware group that gained access to its networks and exfiltrated a significant volume of data. The incident was discovered on August 14th and impacted the Senate Department for Mobility, Transport, Climate Protection, and Environment, leading to the shutdown of both its network and the Senate Department for Urban Development, Construction, and Housing’s network. The attack is believed to have occurred between August 7th and 12th, with investigators now working alongside state criminal police and federal security agencies.
Rhysida claimed to have stolen over 5.7 terabytes of data, including complaints, legal documents, financial records, contracts, human resources files, passwords, and confidential documents. The group further alleged the theft of personal information for over 12,000 residents, including email addresses and phone numbers, alongside payment information like IBANs, plaintext credentials, lawsuit case files, payroll information, passport and ID details, and private data belonging to leadership figures. The group initially added Berlin to its Tor-based leak site on August 28th.
Berlin has not yet identified the specific threat actor behind the attack, but the Rhysida ransomware group has claimed responsibility. The city is currently cooperating with law enforcement agencies to investigate the incident and mitigate any further damage.