Full story
Berlin hit by ransomware
Berlin Mayor Kai Wegner said the city was being blackmailed by hackers who compromised city systems and stole data earlier this month, and he said officials would not give in to the ransom demand received on Thursday evening.
“Berlin's mayor, Kai Wegner, has said the city is being blackmailed”
Der Spiegel reported that the hackers were demanding 30 bitcoin, worth around €2 million, and investigators were working to determine what data was taken after some online systems were forced to shut down.
Investigators said an initial data leak occurred between 7 and 12 August, and on 14 August two department networks were shut down, making applications for housing benefits and payments impossible for several days.
Forensic investigations later revealed further data leaks within Berlin's transport and environment department, and the mayor's office said it could not be ruled out that personal or other non-public data may also be affected.
The Rhysida group, believed to operate from Russia and Eastern Europe and previously behind an attack on the British Museum, reportedly claimed responsibility for the Berlin breach.
Auction threat and denials
A ransomware group said on Friday it was putting up for auction a trove of data it stole from Berlin state agencies, and the Rhysida group said it was auctioning the data at a starting price of 30 bitcoin in just under seven days.
Reuters reported that the group said it intended to auction the 5.79 terabytes of data stolen from Berlin within seven days, and it showed a countdown timer on its website.
In a joint statement on Friday, Berlin Mayor Kai Wegner and Berlin's interior senator Iris Spranger said, "The state of Berlin will not submit to extortion," before the ransomware group claimed the attack on their website.
Wegner told a press conference that officials could not provide details about the content or scope of the affected data because the extent of the breach was still being examined.
Spranger said the city's election infrastructure had not been affected and that, according to security officials, no data related to the election had been compromised.
Elections, outages, and stakes
The cyberattack came less than a month before the city-state holds elections on September 20, and Iris Spranger insisted that election infrastructure had not been compromised.
“Berlin cyber-attack comes about a month before the city holds elections”
Berlin authorities said the election infrastructure did not suffer any damage from the attack, and there were yet no indications of data breaches related to the electoral process.
The attack disrupted services for residents as housing and environmental administrations were particularly affected, with internal networks being inaccessible for seven consecutive days.
The outage delayed housing benefit payments to citizens and processing of urgent requests, causing administrative confusion, while technical experts continued assessments to determine the full scope of the breach.
Der Spiegel published a screenshot from the Rhysida group's dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords, and thousands of personal contact details, with a countdown after which it said it would begin auctioning the data.