Berlin Won’t Pay Extortion Group Claiming Data Theft

Summary

Berlin has stated it will not pay a ransom to the Rhysida ransomware group, which claimed to have stolen over 5TB of data from the city's network. The data exfiltration occurred between August 7 and 12, impacting the Senate Department for Mobility, Transport, Climate Protection, and Environment. Investigations are ongoing, involving state and federal security agencies.

Full text

Berlin, the capital city of Germany, on Friday said it would not pay the extortion group that hacked into its network and stole large amounts of data earlier this month. The incident was discovered on August 14 and impacted the Senate Department for Mobility, Transport, Climate Protection, and Environment. To contain the attack, the department’s network was shut down on August 14, the same as was the Senate Department for Urban Development, Construction, and Housing’s network. According to official statements from governing mayor Kai Wegner and the Senate Chancellery, the data exfiltration occurred between August 7 and 12, and likely involved personal and non-public information. Berlin has not shared further information on the attack, citing the ongoing investigation carried out by the state criminal police, federal security agencies, and the public prosecutor’s office. On Friday, Wegner and Senator for the Interior and Sport Iris Spranger confirmed that the hackers have demanded a ransom payment, but underlined that the city would not pay.Advertisement. Scroll to continue reading. While the city has not named the threat actor behind the attack, the Rhysida ransomware group has claimed responsibility for the incident, briefly adding Berlin to its Tor-based leak site on August 28. The group claimed the theft of over 5.7 terabytes of data, including complaints and legal documents, financial documents, contracts, human resources files, passwords, and confidential documents. Rhysida said it stole the personal information of over 12,000 people, as well as over 16,000 email addresses and close to 12,000 phone numbers. Payment information, including IBANs, plaintext credentials, lawsuit case files, payroll information, passport and ID information, leadership private data, and other data were also allegedly stolen. The extortion group demanded a 30 bitcoin (~$2.3 million) ransom. Related: Hasbro Data Breach Exposed Employee Personal Information Related: Sensitive Information Exposed in Nutex Health Data Breach Related: ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited Related: Personal Information Exposed in Apollo Global Data Breach Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Critical Isolated-vm Vulnerability Leads to RCE on HostRust Supply Chain Attack Linked to North Korean HackersMicrosoft Patches Exploited Entra ID VulnerabilityCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesThreat Actor Hacks 14,000 IP Cameras in Ukraine and RussiaAtlassian, Splunk Patch Dozens of Critical, High-Severity VulnerabilitiesMLflow Vulnerability Exploited for Cloud Credential TheftCisco Patches Critical Crosswork, Secure Workload Vulnerabilities Latest News Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’More Details Emerge on Exploited PaperCut VulnerabilitiesHasbro Data Breach Exposed Employee Personal InformationIn Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker SanctionsATF Confirms Cyber Incident After Ransomware Group Claims AttackOpenAI Agents Exploited Linux Kernel Flaw on Company’s Own SystemsTech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense PledgeThink You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveSocial engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer.Naveen Bhateja has been appointed Chief People Officer at HackerOne.The Department of War has appointed Sonu Shankar as Principal Deputy Chief Information Officer.More People On The MoveExpert Insights The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Rethinking Application Security for the AI Era As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk. (Joshua Goldfarb) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Rhysida

Entities