Overview
- A professional hacker group calling itself Rhysida says it stole about 5.7 terabytes of files from Berlin’s transport and construction senates during an intrusion in early August and has been offering the dataset for sale in a Darknet auction.
- The attackers set a minimum bid of 30 bitcoins and set an ultimatum that expires on Friday, September 4, with the auction still active according to official and reporting sources.
- The Berlin Senate has publicly refused to pay, cut VPN and homeoffice access for the two affected administrations, and ordered mandatory password resets together with stricter password rules across authorities.
- Forensic teams from the Landeskriminalamt and the Staatsanwaltschaft are scanning the Landesnetz to determine whether more data were taken and to trace the intrusion while staff have been warned not to engage with extortion attempts.
- Leaked material reportedly contains plaintext passwords, personnel and disciplinary files, infrastructure analyses and financial details which raise risks of identity fraud, operational disruption, and resale or public disclosure if the auction concludes without intervention.