Berlin is being blackmailed by hackers who compromised city systems and stole data earlier this month, according to Mayor Kai Wegner — the hackers made a ransom demand on Thursday evening, though Wegner did not specify the amount. A report from Der Spiegel states the demand is for 30 bitcoin, valued at approximately €2m (£1.7m).

Hackers Shut Down Key Systems

Some of Berlin’s online systems were forced to close down as a result of the attack. Investigators were working to determine what data had been taken. The city-state reported an initial data leak occurred between 7 and 12 August. On 14 August, two department networks were shut down, making applications for housing benefits and payments impossible for several days.

Rhysida Group Claims Responsibility

The Rhysida group, believed to operate from Russia and eastern Europe, has reportedly taken responsibility for the attack. This group was also linked to a previous cyberattack on the British Museum. According to Reuters, the group plans to auction 5.79 terabytes of data stolen from Berlin in seven days.

“Berlin will not be blackmailed,” Wegner said on Friday. He added that state police, prosecutors, and federal security services were investigating the suspected perpetrators with the utmost urgency. Officials said they are also examining the content and scope of the compromised data with great intensity.

Data Leaks Across Departments

Forensic investigations revealed additional data leaks within Berlin’s transport and environment departments. The mayor’s office stated that it could not rule out the possibility that personal or other non-public data may also have been affected. Authorities in the capital have not officially named the suspected cyber-attackers, though Der Spiegel has published a screenshot of Rhysida’s dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details.

The Rhysida group has claimed hundreds of attacks since 2023, according to studies. It has targeted government institutions and businesses across numerous countries. In 2023, the group successfully infiltrated the British Museum’s computer systems, disrupting services and stealing around 500,000 files. When the UK institution refused to pay the ransom, the group published the files—containing personal data of visitors, subscribers, and staff,on the dark web.

Berlin’s cyber-attack occurred roughly a month before the city holds elections. State senator Iris Spranger emphasized that election infrastructure had not been compromised. The Rhysida group’s dark web site also features a countdown before it begins auctioning the data, with a starting price of 30 bitcoin,the same amount being demanded from Berlin, according to Der Spiegel.