The well-known ransomware group “Rhysida” is apparently behind the cyberattack on the Berlin Senate administration that became known in mid-August. They are demanding 30 Bitcoin from Berlin, currently worth around two million euros. If the state does not pay, extensive data sets totaling 5.8 terabytes are to be published.
As Spiegel reported on Friday evening, security circles had confirmed to the medium that the blackmailers are Rhysida. The criminals have been active for years and gained significant attention in 2023 when they attacked the British National Library. This year, the group attacked the city of Stuttgart, among others. The modus operandi is always the same: data is exfiltrated, followed by the extortion attempt.
However, Berlin does not want to pay. Even before the Spiegel report was published, an extraordinary meeting of the Berlin Senate took place on Friday, after which Governing Mayor Kai Wegner told the German Press Agency (dpa): “The state of Berlin will not be blackmailed.” The city had become the “victim of a serious criminal offense”, the CDU politician continued. Wegner did not want to elaborate on what Berlin was being blackmailed with. However, it could also involve personal data, the Governing Mayor added.
