Ransomware group says it stole Berlin data, offers it for auction

August 28, 2026 10:44 AM EDT

Berlin's Governing Mayor Kai Wegner and Berlin's Senator for Interior, Digitalisation and Sport Iris Spranger attend a press conference about a cyberattack which hit the Berlin's Senate network, in Berlin, Germany, August 28, 2026. REUTERS/Maryam Majd

By Maria Martinez and AJ ‌Vicens

BERLIN, Aug ​28 (Reuters) - A ​ransomware group said on Friday it was putting up for auction a trove of data it stole from Berlin state agencies, and ‌city officials refused to pay.

The Rhysida group, which researchers say operates ⁠from Russia or Eastern Europe, said on its website it took 5.79 terabytes of data ‌including 46,500 contracts as well as ‌emails, phone numbers, passwords and classified information.

The group said it was auctioning the data at a starting price of 30 bitcoin ($77,622) in just under seven ​days, showing a countdown timer on its website.

The cyberattack on Berlin's network comes less than a month before the city-state holds elections on September ⁠20.

'BERLIN WILL NOT SUBMIT TO EXTORTION'

Broadcaster RBB reported on Thursday evening that Berlin had received ransom demands for ​an unspecified amount following the attack.

"The state of Berlin will not submit to extortion," Berlin Mayor Kai Wegner and Berlin's interior ​senator, Iris Spranger, said in a joint ‌statement on Friday, before the ransomware group claimed the attack on their website.

Officials could not provide details on the content or ⁠scope of the affected data because the extent of the breach was still being examined, Wegner said at a press conference.

Spranger said the city's election infrastructure had not been ⁠affected and that, according to security officials, no data related to the election had been ​compromised.

RANSOMWARE GROUP TARGETS GOVERNMENTS

Rhysida has claimed nearly 280 attacks since it emerged in June 2023, according to cybercrime research platform eCrime.ch.

Roughly half of its victims have been in the U.S., followed ‌by the U.K., Canada and Italy, as well as other nations, according to Ransom-DB, a ransomware analysis and tracking service.

The ‌group has repeatedly targeted government institutions, such as the October 2023 hack of the ⁠British Library. The group has ‌also claimed attacks on the ​Chilean army, schools, healthcare facilities and businesses of all sizes.

(Reporting by Cian Muenster, Miranda Murray, Maria Martinez;Editing by Friederike Heine and ‌Cynthia Osterman)



Serious News for Serious Traders! Try StreetInsider.com Premium Free!

You May Also Be Interested In





Related Categories

Reuters

Related Entities

Bitcoin