Berlin won’t pay its hackers – now 5.8TB of government data could go up for auction
The Rhysida group has claimed the attack and says it has made a ransom demand.
Image via Shutterstock
- Rhysida claims it stole 5.79TB from Berlin agencies, including contracts, emails, phone numbers, passwords, and classified data.
- The gang says it will auction the data in seven days, starting at 30 bitcoin.
- Berlin officials say the state will not pay the ransom and investigators are pursuing the attackers.
- Officials say election infrastructure was not affected before Berlin’s September 20 state election.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The Berlin government is being targeted in an extortion campaign after hackers compromised city systems and stole data from state agencies. The data could now be auctioned off in about a week.
The Rhysida group, a cybercriminal gang that is believed to operate from Russia or Eastern Europe, claimed responsibility for the August cyberattack.
On its website, the group said it had stolen 5.79 terabytes of data, including 46,500 contracts, as well as emails, phone numbers, passwords, and classified information.
It added that it will begin auctioning the obtained information in seven days at a starting price of 30 bitcoin, according to Reuters. Its website also now reportedly shows a countdown.
Berlin had already received a ransom demand for an unspecified amount, but officials have publicly said the state would not give in to the extortion attempt.
Berlin's Governing Mayor Kai Wegner and Berlin's interior senator Iris Spranger said in a joint statement on Friday: "The state of Berlin will not be blackmailed.”
“The Berlin State Criminal Police Office, the public prosecutor's office, and the federal security authorities are working closely together to investigate the suspected perpetrators of the hacking attack on the Berlin state network with the utmost urgency.”
The cyberattack on the Berlin Senate administration network occurred in August in what authorities described as an "ICT incident." The term refers to events that compromise the security or confidentiality of data and IT systems. Parts of the systems were taken offline as the government worked to understand the scope of the attack.
All Senate departments were reconnected on August 23rd, but the investigation continues.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The attack comes less than a month before Berlin's state election on September 20th, but Spranger said the election infrastructure had not been affected.
The Rhysida ransomware gang’s previous high-profile victims include the British Library and Insomniac Games. In November 2025, it leaked nearly 2TB of sensitive data from US manufacturing giant Gemini Group, exposing employee and client records across North America.
And in January 2025, it listed a Montreal borough on its dark-web leak site, along with samples of documents allegedly stolen from the borough's government networks.
