Berlin Rejects Rhysida Ransomware Blackmail

Fraud Administration & Cybercrime
,
Geo-Particular
,
Ransomware

Extortion Group With Suspected Russian Provenance Imposes Friday Deadline

David Meyer •
September 2, 2026    

Berlin officers briefly canceled distant work and are scouring all their programs, after the infamous Rhysida ransomware gang attacked the German city-state in a double-extortion try that can come to some sort of conclusion this Friday.

See Additionally: Demostración Del Producto: Backup Y Recuperación De VM

The assault was detected on Aug. 14, and all departments of the Berlin Senate have been instantly disconnected from their central community. These affected within the assault have been the departments for city growth, development and housing – inflicting important disruptions for these making an attempt to assert housing advantages – and for mobility, transport, surroundings and local weather safety.

Berlin mayor Kai Wegner, who withdrew a re-election bid in July, stated initially that no delicate knowledge appeared to have been compromised. That assertion didn’t final lengthy. By final Friday, following forensic investigations, Wegner admitted that public and private knowledge could have been taken between Aug. 7 and Aug. 12, and that the attackers have been making an attempt to blackmail the Berlin authorities.

“The demand got here in early on Thursday night,” Wegner stated. “Berlin is not going to give in to blackmail.”

In keeping with a number of stories citing safety officers and knowledge on the darkweb, and with affirmation from the Berlin Senate on Tuesday, the perpetrator was Rhysida, a prolific outfit that usually targets organizations in the US. A number of American healthcare suppliers have fallen sufferer though a Ransom-DB evaluation in February discovered that just about half of its recognized assaults landed elsewhere on the earth, with Europe that includes strongly.

Rhysida employs the now-standard tactic of double extortion, threatening leaks and the continuing encryption of information on the sufferer’s programs. It focused the German metropolis of Stuttgart in Might of this 12 months, demanding 5 bitcoin in cost for knowledge it claimed to have stolen, though neither the theft nor any ransom cost have been publicly confirmed.

This time, the teams desires 30 bitcoins from Berlin, and says it’s going to publish the information if it doesn’t get the cryptocurrency by this coming Friday. Rhysida is operating an public sale till then, claiming that it’ll solely give the information to at least one purchaser.

In keeping with Rhysida, the group claims to have 5.79 terabytes of Berlin Senate knowledge, together with 16,389 emails, 11,963 telephone numbers, 148 banking codes, tens of 1000’s of contracts and judicial paperwork, and 1000’s of personnel recordsdata containing extra private knowledge.

Rhysida additionally says it took credentials that had been saved in plaintext, together with categorised supplies and vulnerability analyses of Berlin’s water provide.

Berlin Senate spokeswoman Christine Richter reiterated at a Tuesday press convention that town wouldn’t cough up. She stated a “important quantity of information” – a few of it private – had been compromised on the two departments, however to date there was no proof of some other departments being affected. Nonetheless, simply to ensure, “all programs inside the state of Berlin should be scanned to rule out the chance that additional knowledge has been exfiltrated.”

She stated there are 12,000 such programs that must be examined, although all of the programs on the two affected departments have already been checked. Richter’s workplace didn’t reply to a request for info relating to how lengthy all of this may take.

On Tuesday, Richter additionally appeared to substantiate Rhysida’s declare scoring credentials, explaining that passwords for “sure specialised functions” had been compromised, with the consequence that the 2 affected departments have “determined to implement further safety measures” which have resulted in “some operational restrictions, although each departments stay reachable by e-mail.”

The Berlin newspaper Tagesspiegel reported sources within the departments as saying their house workplace entry had been shut off on Monday – they will ship and obtain emails, however they will’t set up VPN entry to their inside networks, forcing them to work from their computer systems within the workplace. Richter confirmed this to the paper.

Tagesspiegel reported earlier within the week that snippets of the stolen knowledge exhibiting unencrypted login particulars had been helpfully saved in recordsdata with names like Password.docx, and that the passwords themselves included the likes of “Sunshine13” – not compliant with the suggestions of the Federal Workplace for Info Safety, it famous.

As for what’s going to occur if Berlin sticks to its weapons and withholds cost, Rhysida has a historical past of constructing good on its threats. In 2023, after the British Library refused to pay the group 20 bitcoin, it revealed round 600 gigabytes of the stolen recordsdata, together with employees particulars that reportedly compelled some to maneuver house.

The Berlin Senate is adamant that the approaching state election on Sept. 20 is not going to be affected by the hack. “The election surroundings is safe, in response to our safety officers,” stated Inside Senator Iris Spranger.

It stays unclear the place Rhysida is predicated, though earlier analyses have hinted at a reference to Russia and its satellites. The cybersecurity agency Cynet famous in 2023 that Rhysida’s ransomware software program, ransom notes and leak website typically included snippets of Russian, and the group conspicuously prevented focusing on organizations in Russia and different post-Soviet states. And, in fact, Russia has been stepping up sabotage and drone assault efforts in Germany within the final 12 months or two, because of Germany’s help for Ukraine – on Tuesday the federal government accused Russia of waging hybrid battle.

“There isn’t a proof of connections to Russia and even the Russian state” within the Berlin hack, Richter informed the Berliner Morgenpost on Tuesday, “however such connections can’t be dominated out.”