Ransomware group says it stole Berlin data, offers it for auction
Berlin's Governing Mayor Kai Wegner and Berlin's Senator for Interior, Digitalisation and Sport Iris Spranger attend a press conference about a cyberattack which hit the Berlin's Senate network, in Berlin, Germany, August 28, 2026. REUTERS/Maryam Majd
By Maria Martinez and AJ Vicens
BERLIN, Aug 28 (Reuters) - A ransomware group said on Friday it was putting up for auction a trove of data it stole from Berlin state agencies, and city officials refused to pay.
The Rhysida group, which researchers say operates from Russia or Eastern Europe, said on its website it took 5.79 terabytes of data including 46,500 contracts as well as emails, phone numbers, passwords and classified information.
The group said it was auctioning the data at a starting price of 30 bitcoin ($77,622) in just under seven days, showing a countdown timer on its website.
The cyberattack on Berlin's network comes less than a month before the city-state holds elections on September 20.
'BERLIN WILL NOT SUBMIT TO EXTORTION'
Broadcaster RBB reported on Thursday evening that Berlin had received ransom demands for an unspecified amount following the attack.
"The state of Berlin will not submit to extortion," Berlin Mayor Kai Wegner and Berlin's interior senator, Iris Spranger, said in a joint statement on Friday, before the ransomware group claimed the attack on their website.
Officials could not provide details on the content or scope of the affected data because the extent of the breach was still being examined, Wegner said at a press conference.
Spranger said the city's election infrastructure had not been affected and that, according to security officials, no data related to the election had been compromised.
RANSOMWARE GROUP TARGETS GOVERNMENTS
Rhysida has claimed nearly 280 attacks since it emerged in June 2023, according to cybercrime research platform eCrime.ch.
Roughly half of its victims have been in the U.S., followed by the U.K., Canada and Italy, as well as other nations, according to Ransom-DB, a ransomware analysis and tracking service.
The group has repeatedly targeted government institutions, such as the October 2023 hack of the British Library. The group has also claimed attacks on the Chilean army, schools, healthcare facilities and businesses of all sizes.
(Reporting by Cian Muenster, Miranda Murray, Maria Martinez;Editing by Friederike Heine and Cynthia Osterman)
Serious News for Serious Traders! Try StreetInsider.com Premium Free!
You May Also Be Interested In
- Iran's Khamenei urges Gulf rulers in written message to confront 'real enemy'
- Europe's central bankers fear more turbulence in testy U.S. relations
- Storm leaves one dead, two injured in Cyprus
Create E-mail Alert Related Categories
ReutersRelated Entities
BitcoinSign up for StreetInsider Free!
Receive full access to all new and archived articles, unlimited portfolio tracking, e-mail alerts, custom newswires and RSS feeds - and more!



Tweet
Share