Hackers demand $2.3M in ransom after breaching Berlin government network

Hackers who breached Berlin's government IT network have issued a ransom demand, threatening to release nearly 6 terabytes of data if payment is not made, German media reported Saturday.

According to the weekly magazine Der Spiegel, the ransomware group Rhysida claimed responsibility in a dark-web post and demanded 30 bitcoin — roughly 2 million euros ($2.3 million).

The group warned it would publish the stolen data if the ransom was not paid, setting a countdown that left Berlin one week to meet the demand.

Berlin's city-state administration held an emergency meeting on Friday to discuss the incident, according to public broadcaster RBB. "The State of Berlin has fallen victim to a serious crime," Governing Mayor Kai Wegner said after the meeting. "Berlin will not allow itself to be blackmailed," he added.

According to media reports, the ransomware group claims it seized materials including records from nearly 80,000 administrative fine proceedings, more than 46,500 contracts, information on critical infrastructure facilities, judicial documents, emergency plans, passwords, and nearly 6,000 files containing login credentials.

Authorities determined that the hackers had been inside the network earlier than initially believed, with data exfiltration occurring "at least since Aug. 7."

The leak was first detected on Aug. 14 and, as a precaution, several ministries were temporarily disconnected from the network in mid-August while officials worked to contain the breach.

The compromised system, known as BeLa, is a high-speed fiber-optic network that links hundreds of offices across Berlin's city-state administration. It is operated by the state IT service provider ITDZ Berlin.