Berlin City Government Reportedly Ransomware Attack After Cyber Attack Two Weeks Ago, Demanding 30 Bitcoins, Approximately 2 Million Euros
After the Berlin city government was attacked two weeks ago, it has reportedly been extorted by a hacker group. German publications "Die Zeit" and "Der Spiegel" state that the attackers are suspected to be Rhysida, which has been active for many years, demanding payment of 30 bitcoins, approximately 2 million euros, and threatening to release data.
The group claims to possess nearly 6 terabytes of material on a leak site, including tens of thousands of violation handling records, about 46,500 contracts, passwords, and approximately 6,000 login data. The state government has not confirmed the extent of the leak or verified the amount and identity of the attackers, stating that it will not comment for "investigative strategy reasons."
Berlin Mayor Kai Wegner stated after a special Senate meeting that Berlin is a victim of serious crime and will not yield to extortion. Interior Senator Iris Spranger stated that the election infrastructure has not been affected. The state election will be held on September 20.
The departments mainly affected are transportation and housing management. After the incident on August 14, these two departments were isolated from the state government network for about a week, and the application and issuance of housing subsidies were interrupted for several days. Authorities initially stated that only public data had leaked, but later revised this to suggest that personal data may also be affected.
Since emerging in 2023, Rhysida has claimed nearly 280 attacks, including the British Library and Stuttgart city among its previous claims. The organization has also set a starting price of 30 bitcoins for this batch of data in an auction countdown.
In market mechanisms, the buyers are black market bidders wanting to purchase stolen government data, while the sellers are the threats of leaks after Berlin refuses to pay. The incident is driven by the isolation of government networks and the ransom note, with the funding path clearly cut off by the municipality; the beneficiaries are the public finance precedents that refuse to pay ransom, while those under pressure are the parties whose violation records, contracts, and login information may be made public.
Source: Public Information
ABAB AI Insight
After the municipal network was isolated, the ransom became a political event. The transportation and construction departments were the first to go offline, housing subsidies were suspended, and then the bitcoin quote appeared. Rhysida packaged nearly 6 terabytes as a commodity, with 30 bitcoins as the price and the auction countdown as the sales page. The city government stated "not to pay" before confirming the list, aiming to lock down the business model first and then assess the losses.
The capital path is a dual-track monetization of ransomware: pay the ransom to unlock, or do not pay and auction the data package. If money comes in, it will enter a mixed currency address from the municipal budget; if not, the data package goes to the next auction. Berlin chose the latter. With elections approaching, the timing of the attack has made cybersecurity a campaign issue, but officials stated that the voting system itself was not compromised.
Comparisons can be made to the British Library being named by the same organization, Stuttgart city facing similar extortion, and the public stance of European and American cities on "not paying ransom." Local governments are at a stage where system interconnectivity, backup, and segmented isolation lag behind the pace of attacks: first claiming no sensitive data, then revising to possibly having some, indicating that the asset list cannot keep up with the invasion clock.
Structurally, this falls at the intersection of regulatory changes and capital concentration. The mechanism is: when public data can be packaged and priced, municipal security shifts from an IT issue to whether to open the cash flow for crime. Not paying cuts off the blood supply but does not automatically recover files that have already been copied. Isolation can stop the spread but cannot stop copies that have already gone out.
ABAB News · Cognitive Law
Not paying ransom cuts off the blood supply, but does not recover copies that have already gone out.
Once government data can be packaged, an auction countdown will appear.
Isolating the network first is necessary to turn extortion from a system incident into a political decision.