A ransomware group identified as Rhysida has listed approximately 5.79 terabytes of data stolen from Berlin state agencies for auction online, following the refusal of city officials to meet a ransom demand. The group set the starting bid at 30 bitcoin, equivalent to roughly $77,622, with just under seven days remaining for bids to be placed.
The stolen data includes 46,500 contracts along with emails, phone numbers, passwords, and classified information, according to cybercrime researchers. Rhysida, which researchers link to operations originating from Russia or Eastern Europe, has claimed responsibility for nearly 280 attacks since emerging in June 2023.
Berlin Mayor Kai Wegner and the city’s interior senator, Iris Spranger, issued a joint statement on Friday asserting that the state would not submit to extortion. "The state of Berlin will not submit to extortion," the statement read, emphasizing the city’s stance against paying ransom demands in response to cyberattacks.
City officials have not disclosed the ransom amount demanded or the full scope of the breach, citing ongoing investigations into the incident. Spranger confirmed that election infrastructure remained unaffected, with no election-related data compromised ahead of the September 20 vote. Broadcaster RBB reported the breach late Thursday, prompting public and political scrutiny.
Cybersecurity researchers at eCrime.ch have been tracking Rhysida’s activities and noted the group’s auction timeline as part of their broader assessment of the incident.
