Rhysida gives Berlin seven days before it auctions 5.79TB of city data
Kai Wegner has ruled out paying, which leaves a seven-day clock running on 5.79 terabytes the group says it holds. Two Berlin department networks were already offline for days, and the city still cannot say what was in the files.
The Watch · Security desk
What happened
- Berlin city-state officials date the initial data leak to between 7 and 12 August, the start of a compromise the mayor now describes as blackmail.
- Two department networks were taken offline on 14 August, which made housing benefit applications and payments impossible for several days.
- The ransom demand reached the city on Thursday evening, and Wegner answered on Friday that Berlin will not be blackmailed and officials would not cave in.
- Rhysida's website says it will begin auctioning the 5.79 terabytes it took from Berlin in seven days, according to Reuters.
- Berlin's authorities have not named a perpetrator, which leaves the group's own reported claim of responsibility as the only attribution in circulation.
Why it matters
- What it sets up precedent The British Museum case tells Berlin what a refusal buys, so the choice in front of the city is who absorbs a publication it cannot stop, not whether to pay.
- What it costs cost If passwords really are in the stolen set, the spend is credential rotation and individual notification reaching departments that were never on the intrusion path.
- What it limits constraint Isolating networks shifts the loss onto benefit claimants waiting on payments, a cost that never lands in the city's IT budget line.
- What doesn't add up contradiction The extortionist's file inventory is specific while the city's own confirmation is not, so anyone assessing their exposure is currently reading the seller's catalogue.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
Refusal has a documented outcome with this group. Rhysida took around 500,000 files from the British Museum in 2023 and published them on the dark web after the museum declined to pay, including personal data on visitors, subscribers and staff [18]. The same mechanism is now pointed at Berlin, with one detail worth reading closely: the auction starting price on Rhysida's listing is 30 bitcoin, the identical figure demanded from the city, according to Der Spiegel [8]. Wegner never confirmed a sum himself, and the 30-bitcoin number with its rough two-million-euro valuation is Der Spiegel's reporting [6]. A refusal does not make the data go away; it simply moves the same price tag from the city to whoever bids.
Scope remains the city's open question. Officials have confirmed further leaks inside Berlin's transport and environment department [11] and say personal or other non-public data cannot be ruled out [4]. Rhysida's listing is far more specific than that, claiming contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details [5]. State police, prosecutors and federal security services are all on the investigation [14], and none of them has publicly named the group the city is dealing with [17].
The containment record holds the wider lesson. It is narrower than it looks. Berlin isolated two department networks on 14 August and lost citizen-facing services for days [10]. The first known leak began 7 August, which puts seven days between earliest exfiltration and shutdown [15]. That seven-day gap governs how much data leaves a network. One city choosing isolation over availability, in one incident, is a record that covers Berlin alone.
Rhysida has claimed hundreds of attacks since it emerged in 2023, against government institutions and businesses of varying sizes in numerous countries [7]. The countdown and the auction are its routine pressure instrument, applied well beyond any single German capital. On that pattern, the order of events to expect is publication ahead of the completion of Berlin's own forensics [16], which means residents learn what was taken from a criminal listing rather than from the city that held it [4].
What to watch
- Whether Rhysida posts the files when its countdown expires or extends the deadline to keep pressure on the city.
- Whether Berlin's forensics confirm personnel files and passwords in the stolen set, or contradict the listing's inventory.
- Whether any published material touches election administration, which state senator Iris Spranger says was not compromised a month before the vote.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap−25
- Incentives60
- Confidence62
Perspective Coverage
3 publishers- Builder
- Builder 13%
- Operator
- Operator 77%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Berlin mayor Kai Wegner said the city is being blackmailed by hackers who compromised city systems and stole data earlier this month.
- [2]
The ransom demand came on Thursday evening; Wegner said on Friday that officials would not cave in, stating 'Berlin will not be blackmailed'.
- [3]
The Rhysida group, thought to operate from Russia and eastern Europe, has reportedly taken responsibility for the Berlin attack.
- [4]
The mayor's office said it cannot be ruled out that personal or other non-public data may also be affected.
- [5]
Der Spiegel is carrying a screenshot of Rhysida's dark web site claiming to possess files including contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details.
- [6]
Wegner did not say how much was being sought; Der Spiegel reports the demand is 30 bitcoin, worth around EUR 2m.
- [7]
Rhysida has claimed hundreds of attacks since it emerged in 2023 and has targeted government institutions and businesses of varying sizes in numerous countries.
- [8]
Rhysida's dark web site displays a countdown and an auction starting price of 30 bitcoin, the same amount being sought from Berlin, Der Spiegel reports.
- [9]
Officials for the city-state said an initial data leak occurred between 7 and 12 August.
- [10]
On 14 August two department networks were shut down, making applications for housing benefits and payments impossible for several days.
- [11]
Forensic investigations have since revealed further data leaks within Berlin's transport and environment department, officials said.
- [12]
The Berlin attack comes roughly a month before the city holds elections; state senator Iris Spranger said election infrastructure had not been compromised.
- [13]
Some of Berlin's online systems were forced to close down as a result of the attack.
- [14]
Wegner said state police, prosecutors and federal security services were investigating the suspected perpetrators with the utmost urgency.
- [15]
Seven days separated the start of the initial data leak on 7 August from the 14 August shutdown of two department networks.
- [16]
Rhysida has said on its website that it intends to begin auctioning the 5.79 terabytes of data stolen from Berlin in seven days' time, according to Reuters.
- [17]
Authorities in Berlin have not named the suspected cyber-attackers.
- [18]
Rhysida infiltrated the British Museum's systems in 2023, disrupting services and stealing around 500,000 files; when the museum refused to pay, the group published the files, containing personal data of visitors, subscribers and staff, on the dark web.
Sources
3 independent publishers whose own reporting we read for this story.
- bbc.comBerlin is being blackmailed by hackers, mayor says
1 article · September 5, 2026
- infosecurity-magazine.comRhysida Publishes Berlin Government Data After €2m Extortion Demand Refused
1 article · September 7, 2026
- therecord.mediaBerlin investigates new data leak after hackers publish stolen login credentials
1 article · September 7, 2026
Topics and entities
Entities
- Federal Office for Information Security
- Rhysida
- LoremIpsumLoader