Berlin Hit by Ransomware Attack as Rhysida Group Auctions Stolen Data
Berlin state agencies are grappling with a major ransomware attack after the Rhysida group claimed to have stolen 5.79 terabytes of sensitive data, including 46,500 contracts, emails, phone numbers, passwords, and classified information. The cybercriminals, believed to operate from Russia or Eastern Europe, announced on August 28 that they would auction the data with a starting bid of 30 bitcoin ($77,622) and a seven-day countdown.
The attack comes less than a month before Berlin’s September 20 elections, though officials confirmed that election infrastructure and related data remain unaffected. Berlin Mayor Kai Wegner and Interior Senator Iris Spranger issued a joint statement rejecting the ransom demands, declaring, "The state of Berlin will not submit to extortion." The full extent of the breach is still under investigation, with authorities unable to confirm the scope of compromised data.
Rhysida, active since June 2023, has claimed nearly 280 attacks, primarily targeting U.S. and European entities. The group has a history of breaching government institutions, including the British Library in October 2023, as well as military, healthcare, and educational organizations. This latest incident underscores the persistent threat ransomware groups pose to public sector infrastructure.
Source: https://www.globalbankingandfinance.com/berlin-city-government-wont-submit-extortion-pre-election/
Berlin state agencies TPRM report: https://www.rankiteo.com/company/landberlin
"id": "lan1787963614",
"linkid": "landberlin",
"type": "Ransomware",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Public Sector',
'location': 'Berlin, Germany',
'name': 'Berlin state agencies',
'type': 'Government'}],
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '46,500 contracts',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Contracts',
'Emails',
'Phone numbers',
'Passwords',
'Classified information']},
'date_publicly_disclosed': '2024-08-28',
'description': 'Berlin state agencies are grappling with a major ransomware '
'attack after the Rhysida group claimed to have stolen 5.79 '
'terabytes of sensitive data, including 46,500 contracts, '
'emails, phone numbers, passwords, and classified information. '
'The cybercriminals announced they would auction the data with '
'a starting bid of 30 bitcoin ($77,622) and a seven-day '
'countdown. The attack comes less than a month before Berlin’s '
'September 20 elections, though officials confirmed that '
'election infrastructure and related data remain unaffected.',
'impact': {'brand_reputation_impact': 'Significant',
'data_compromised': '5.79 terabytes',
'identity_theft_risk': 'High',
'operational_impact': 'Major disruption to Berlin state agencies'},
'initial_access_broker': {'data_sold_on_dark_web': 'Auction announced'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain, extortion',
'ransomware': {'data_exfiltration': 'Yes',
'ransom_demanded': '30 bitcoin ($77,622)',
'ransom_paid': 'No',
'ransomware_strain': 'Rhysida'},
'references': [{'source': 'Cyber incident report'}],
'response': {'communication_strategy': 'Joint statement rejecting ransom '
'demands'},
'threat_actor': 'Rhysida',
'title': 'Berlin Hit by Ransomware Attack as Rhysida Group Auctions Stolen '
'Data',
'type': 'Ransomware'}