Berlin authorities are facing an extortion attempt after the Rhysida cybercrime group claimed responsibility for an August attack on the German capital’s government IT infrastructure.
Rhysida says it obtained 5.79 terabytes of information from Berlin’s systems. The group claims the stolen material includes approximately 46,500 contracts as well as emails, telephone numbers, passwords, and classified information. These claims have not been independently confirmed.
The attackers are threatening to auction the stolen data if their demands are not met. Rhysida reportedly placed a seven-day countdown on its leak site and set the starting price for the information at 30 bitcoin.
Berlin has already received a ransom demand, although authorities have not disclosed how much money the attackers requested. Officials have made clear that the government does not intend to pay.
“The state of Berlin will not be blackmailed,” Governing Mayor Kai Wegner and Interior Senator Iris Spranger said in a joint statement. They added that Berlin’s State Criminal Police Office and public prosecutor’s office are working with federal security authorities to investigate the attack and identify those responsible.
The incident affected the Berlin Senate administration network in August and was initially described by authorities as an “ICT incident.” Some systems were disconnected while officials investigated the intrusion and assessed its impact.
All Senate departments had been reconnected to the network by August 23rd, although the investigation into the attack and possible data theft remains underway.
The timing is particularly notable because Berlin is scheduled to hold its state election on September 20th. Spranger said the systems supporting the election were not compromised by the cyberattack.
Rhysida is a ransomware and extortion group that has previously targeted major organizations and government-related entities. Its past victims have included the British Library and video game developer Insomniac Games.
The group also claimed responsibility for an attack against US manufacturer Gemini Group in 2025, subsequently releasing nearly two terabytes of information that reportedly contained employee and customer records. Earlier that year, Rhysida listed a Montreal borough on its leak site and published samples of documents it claimed had been obtained from government networks.
Berlin authorities have not confirmed the full volume or categories of information Rhysida claims to possess. The group’s assertions about the 5.79 terabytes of stolen data, thousands of contracts, passwords, and classified material therefore remain attacker claims while the official investigation continues.
With Rhysida threatening to sell the information within days, German authorities are continuing their investigation while maintaining that Berlin will not comply with the group’s extortion demands.