After the Berlin city government was attacked two weeks ago, it has reportedly been extorted by a hacker group. German publications "Die Zeit" and "Der Spiegel" state that the attackers are suspected to be Rhysida, which has been active for many years, demanding payment of 30 bitcoins, approximately 2 million euros, and threatening to release data.

The group claims to possess nearly 6 terabytes of material on a leak site, including tens of thousands of violation handling records, about 46,500 contracts, passwords, and approximately 6,000 login data. The state government has not confirmed the extent of the leak or verified the amount and identity of the attackers, stating that it will not comment for "investigative strategy reasons."

Berlin Mayor Kai Wegner stated after a special Senate meeting that Berlin is a victim of serious crime and will not yield to extortion. Interior Senator Iris Spranger stated that the election infrastructure has not been affected. The state election will be held on September 20.

The departments mainly affected are transportation and housing management. After the incident on August 14, these two departments were isolated from the state government network for about a week, and the application and issuance of housing subsidies were interrupted for several days. Authorities initially stated that only public data had leaked, but later revised this to suggest that personal data may also be affected.

Since emerging in 2023, Rhysida has claimed nearly 280 attacks, including the British Library and Stuttgart city among its previous claims. The organization has also set a starting price of 30 bitcoins for this batch of data in an auction countdown.

In market mechanisms, the buyers are black market bidders wanting to purchase stolen government data, while the sellers are the threats of leaks after Berlin refuses to pay. The incident is driven by the isolation of government networks and the ransom note, with the funding path clearly cut off by the municipality; the beneficiaries are the public finance precedents that refuse to pay ransom, while those under pressure are the parties whose violation records, contracts, and login information may be made public.

Source: Public Information