Rhysida ransomware group auctions stolen Berlin state data

A ransomware group has claimed responsibility for a cyberattack on Berlin's state network and is auctioning stolen data, while city officials have firmly refused to give in to extortion demands.

The group, identified by researchers as Rhysida and believed to operate from Russia or Eastern Europe, said on its website that it had taken 5.79 terabytes of data. This includes approximately 46,500 contracts, along with emails, phone numbers, passwords, and classified information. The group has set a starting price of 30 bitcoin (roughly $77,622) for the data, displaying a countdown timer of just under seven days on its website.

The attack comes less than a month before Berlin is scheduled to hold state elections on September 20. Berlin Mayor Kai Wegner and Interior Senator Iris Spranger issued a joint statement on Friday, asserting that "the state of Berlin will not submit to extortion." This statement was released before the ransomware group publicly claimed the attack.

At a press conference, Wegner said officials could not yet provide details on the content or scope of the affected data, as the extent of the breach is still under investigation. Spranger assured the public that the city's election infrastructure had not been affected and that, according to security officials, no election-related data had been compromised.

Rhysida has claimed nearly 280 attacks since it emerged in June 2023, according to cybercrime research platform eCrime.ch. Data from Ransom-DB, a ransomware analysis and tracking service, indicates that roughly half of its victims have been in the United States, followed by the UK, Canada, Italy, and other nations. The group has repeatedly targeted government institutions, including the October 2023 hack of the British Library, and has also claimed attacks on the Chilean army, schools, healthcare facilities, and businesses of various sizes.