Overview
- The Berlin Senate confirmed on Friday that the city is being extorted and said it will not pay a 30 Bitcoin ransom that attackers are demanding for stolen data.
- Officials and forensic teams are investigating after attackers claimed to have copied about 5.7–6 TB of files, including contracts, regulatory case records, login data and documents tied to infrastructure and emergency plans.
- Authorities now say data were exfiltrated earlier than first reported, with the Senate identifying flows between August 7 and August 12 and the intrusion first made public on August 14.
- Two senatorial administrations were cut off from the Landesnetz for about a week and services such as Wohngeld processing were disrupted, but the Senate says election systems for the September 20 vote were not compromised.
- Security sources link the posting to the Rhysida ransomware group, investigators warn stolen credentials can fuel fraud or resale on criminal markets, and state and federal prosecutors with external cybersecurity contractors continue forensic and criminal inquiries.