Hackers have breached Berlin's government computer network, stealing nearly 6 terabytes of sensitive data and demanding a ransom of 30 bitcoin — roughly €2 million — from the German capital. Berlin's governing mayor, Kai Wegner, confirmed the extortion attempt on Friday at a press conference held at the city's historic Red City Hall, declaring firmly: "Berlin will not be blackmailed."

The initial data breach took place between 7 and 12 August, but was only discovered on 14 August, when two department networks — covering urban development and the environment — were taken offline as a precaution, temporarily suspending housing benefit applications and payments. Forensic investigators subsequently found that data leaks had occurred within both departments before the network shutdown, and officials acknowledged they could not rule out that personal or other non-public information had been compromised. Earlier in the week, Berlin's Chief Digital Officer had initially indicated that only publicly available geodata had been taken, before later revising that assessment. A US cybersecurity firm has been brought in to help determine the full scope of the breach, a process that could take months.

Responsibility for the attack has been claimed by the Rhysida ransomware group, which cybersecurity researchers believe operates from Russia and eastern Europe. On its dark web site, Rhysida announced it had seized 5.79 terabytes of files — including roughly 46,500 contracts, non-disclosure agreements, personnel records, passwords, email addresses and phone numbers — and set a countdown of less than seven days before it intends to auction the data, with a starting bid of 30 bitcoin. The group has claimed approximately 280 attacks since it emerged in June 2023, targeting government institutions, hospitals, schools and businesses across numerous countries. It previously infiltrated the British Museum in 2023, and when that institution refused to pay, Rhysida published hundreds of thousands of stolen files on the dark web.

Berlin's interior senator, Iris Spranger, stressed that election infrastructure had not been affected, and that security officials had confirmed no election-related data was compromised. The disclosure is particularly sensitive as the city-state prepares to hold elections to its state parliament and district assemblies on 20 September, less than a month away. Federal interior ministry officials have offered the support of all relevant national security agencies, and state police, prosecutors and federal cybersecurity services are investigating "with the utmost urgency," Wegner said.

The attack highlights the growing threat posed by ransomware groups to public institutions. Rather than encrypting systems and demanding payment to restore access — the classic ransomware playbook — Rhysida appears in this case to have focused on data theft and the threat of public exposure, a tactic that places pressure on governments to pay or risk the release of citizens' private information. Whether Berlin's refusal to negotiate will lead to the threatened data auction remains to be seen, and officials have not yet publicly confirmed whether the ransom demand definitively originated from the same actors who conducted the breach.