- A hacking group called Rhysida says it broke into Berlin’s government computers and stole almost 5.8 terabytes of files.
- City officials refused to pay any ransom, so the group now plans to auction the stolen data for 30 bitcoin.
- The attack hit just weeks before Berlin’s election, though officials say the voting systems stayed safe.
Cities rarely expect their own records to show up for sale online. Berlin now faces that exact problem. A ransomware group claims it broke into the city-state’s network and walked away with a huge pile of data.
City leaders refused to pay up, so the hackers moved to plan B. They put the stolen files up for auction on the dark web, and the clock is already ticking.
Hackers Say They Grabbed Nearly 6 Terabytes of Files
The Rhysida group posted its claims on its own dark web site on Friday, August 28. According to the group, it took 5.79 terabytes of data from Berlin’s state agencies. That works out to roughly 1.44 million individual files.
The haul allegedly includes emails, phone numbers, internal documents, and passwords. It also reportedly contains more than 46,500 contracts tied to the city government. A post on X by user @Crypto__Goku added that some passwords sat inside one unencrypted Word file, saved under the plain name “Passwort.docx.” That single file, if real, could have handed attackers a shortcut into other city systems.
The same post claims the first signs of a leak turned up as early as August 7. It says the affected city offices were not cut off from the network until August 14, about a week later. Researchers say Rhysida likely operates out of Russia or Eastern Europe, though its exact base remains unconfirmed.
The group set a countdown timer on its site. It gave Berlin just under seven days to meet its price before the auction opens to buyers. The starting bid sits at 30 bitcoin, which Reuters valued at about $77,622. The X post instead pegged the same 30 bitcoin demand at roughly 2 million euros, a gap likely tied to exchange rates or timing.
City Leaders Refuse to Give in
News outlet RBB reported Thursday evening that Berlin had received a ransom demand after the attack. The exact amount was not shared at that point.
Berlin Mayor Kai Wegner and interior senator Iris Spranger addressed the attack together on Friday. In a joint statement, they made the city’s position clear. Berlin, they said, would not bow to demands for payment. Their statement landed before Rhysida had even posted its claim on its own site.
At a press briefing, Wegner said officials could not yet share details about the stolen data. He explained that investigators were still working to measure how deep the breach went. Spranger added a note of reassurance on one front. She said Berlin’s election systems had not been touched by the attack. Security officials, she noted, found no sign that election-related data had been exposed.
That reassurance matters given the timing. Berlin’s city-state election took place on September 20, less than a month after the breach became public. A cyberattack landing so close to a vote naturally raises extra concern, even when the core voting infrastructure stays untouched.
A Familiar Pattern for this Hacking Group
Rhysida is not new to this kind of headline. Cybercrime research group eCrime.ch counts almost 280 attacks linked to the group since it first surfaced in June 2023.
Tracking service Ransom-DB says close to half of its victims sit in the United States. The United Kingdom, Canada, and Italy round out much of the rest of its target list, alongside other countries worldwide.
Government bodies have shown up repeatedly among its targets. Rhysida claimed responsibility for hacking the British Library back in October 2023, an attack that drew wide attention at the time. The group has also claimed hits on Chile’s army, along with schools, healthcare providers, and companies of every size.
That track record gives Berlin’s case a familiar shape. A public institution gets hit, a ransom gets demanded, and the target refuses to pay. What happens next usually depends on how much the stolen data is actually worth to buyers on the dark web.
Rhysida’s activity reflects the growing ransomware threat. Searchlight Cyber recorded 7,458 victims on dark web leak sites in 2025, up 30% from 2024, with 73 new ransomware groups emerging. Rhysida’s use of data theft and leak threats has become a common extortion tactic.
For now, Berlin has confirmed the breach and the extortion attempt, but not the full scope of what the hackers actually took. Investigators are still working through the case, and the auction countdown keeps running in the meantime.
