{"id":158102,"date":"2026-09-02T23:37:16","date_gmt":"2026-09-02T23:37:16","guid":{"rendered":"https:\/\/www.europesays.com\/dk\/158102\/"},"modified":"2026-09-02T23:37:16","modified_gmt":"2026-09-02T23:37:16","slug":"berlin-rejects-rhysida-ransomware-blackmail","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/dk\/158102\/","title":{"rendered":"Berlin Rejects Rhysida Ransomware Blackmail"},"content":{"rendered":"

\n Fraud Management & Cybercrime<\/a>
\n ,
\n Geo-Specific<\/a>
\n ,
\n Ransomware<\/a>\n <\/p>\n

Extortion Group With Suspected Russian Provenance Imposes Friday Deadline<\/p>\n

David Meyer<\/a> \u2022
\n September 2, 2026 \u00a0 \u00a0 <\/p>\n

\"Berlin
\n Image: TTstudio\/Shutterstock\/ISMG <\/p>\n

Berlin officials temporarily canceled remote work and are scouring all their systems, after the notorious Rhysida ransomware gang attacked the German city-state in a double-extortion attempt that will come to some kind of conclusion this Friday.<\/p>\n

See Also: Demostraci\u00f3n Del Producto: Backup Y Recuperaci\u00f3n De VM<\/a><\/p>\n

The attack was detected on Aug. 14, and all departments of the Berlin Senate were immediately disconnected from their central network. Those affected in the attack were the departments for urban development, construction and housing – causing significant disruptions for those trying to claim housing benefits – and for mobility, transport, environment and climate protection. <\/p>\n

Berlin mayor Kai Wegner, who withdrew a re-election bid in July, said<\/a> initially that no sensitive data appeared to have been compromised. That assertion didn\u2019t last long. By last Friday, following forensic investigations, Wegner admitted that public and non-public data may have been taken between Aug. 7 and Aug. 12, and that the attackers were trying to blackmail the Berlin government. <\/p>\n

“The demand came in early on Thursday evening,” Wegner said. “Berlin will not give in to blackmail.”<\/p>\n

According to multiple reports citing security officials and information on the darkweb, and with confirmation<\/a> from the Berlin Senate on Tuesday, the culprit was Rhysida, a prolific outfit that often targets organizations in the United States. Multiple American healthcare<\/a> providers have fallen victim<\/a> although a Ransom-DB analysis in February found<\/a> that almost half of its known attacks landed elsewhere in the world, with Europe featuring strongly. <\/p>\n

Rhysida employs the now-standard tactic of double extortion, threatening leaks and the ongoing encryption of data on the victim\u2019s systems. It targeted the German city of Stuttgart in May of this year, demanding 5 bitcoin in payment for data it claimed to have stolen, although neither the theft nor any ransom payment have been publicly confirmed.<\/p>\n

This time, the groups wants 30 bitcoins from Berlin, and says it will publish the data if it doesn\u2019t get the cryptocurrency by this coming Friday. Rhysida is running an auction until then, claiming that it will only give the data to one buyer.<\/p>\n

According to Rhysida, the group claims to have 5.79 terabytes of Berlin Senate data, including 16,389 emails, 11,963 phone numbers, 148 banking codes, tens of thousands of contracts and judicial documents, and thousands of personnel files containing more personal data. <\/p>\n

Rhysida also says it took credentials that had been stored in plaintext, along with classified materials and vulnerability analyses of Berlin\u2019s water supply.<\/p>\n

Berlin Senate spokeswoman Christine Richter reiterated<\/a> at a Tuesday press conference that the city would not cough up. She said a “significant amount of data” – some of it non-public – had been compromised at the two departments, but so far there was no evidence of any other departments being affected. Still, just to make sure, “all systems within the state of Berlin must be scanned to rule out the possibility that further data has been exfiltrated.” <\/p>\n

She said there are 12,000 such systems that need to be examined, though all the systems at the two affected departments have already been checked. Richter\u2019s office did not respond to a request for information regarding how long all of this might take.<\/p>\n

On Tuesday, Richter also appeared to confirm Rhysida\u2019s claim scoring credentials, explaining that passwords for “certain specialized applications” had been compromised, with the result that the two affected departments have “decided to implement additional security measures” that have resulted in “some operational restrictions, though both departments remain reachable by email.”<\/p>\n

The Berlin newspaper Tagesspiegel reported<\/a> sources in the departments as saying their home office access had been shut off on Monday – they can send and receive emails, but they can\u2019t establish VPN access to their internal networks, forcing them to work from their computers in the office. Richter confirmed this to the paper.<\/p>\n

Tagesspiegel reported<\/a> earlier in the week that snippets of the stolen data showing unencrypted login details had been helpfully stored in files with names like Password.docx, and that the passwords themselves included the likes of “Sunshine13” – not compliant with the recommendations of the Federal Office for Information Security, it noted.<\/p>\n

As for what will happen if Berlin sticks to its guns and withholds payment, Rhysida has a history of making good on its threats. In 2023, after the British Library refused to pay the group 20 bitcoin, it published around 600 gigabytes of the stolen files, including staff details that reportedly<\/a> forced some to move home. <\/p>\n

The Berlin Senate is adamant that the coming state election on Sept. 20 will not be affected by the hack. “The election environment is secure, according to our security officers,” said Interior Senator Iris Spranger.<\/p>\n

It remains unclear where Rhysida is based, although previous analyses have hinted at a connection with Russia and its satellites. The cybersecurity firm Cynet noted<\/a> in 2023 that Rhysida\u2019s ransomware software, ransom notes and leak site sometimes included snippets of Russian, and the group conspicuously avoided targeting organizations in Russia and other post-Soviet states. And, of course, Russia has been stepping up sabotage and drone attack efforts in Germany in the last year or two, due to Germany\u2019s support for Ukraine – on Tuesday the government accused<\/a> Russia of waging hybrid war.<\/p>\n

“There is no evidence of connections to Russia or even the Russian state” in the Berlin hack, Richter told<\/a> the Berliner Morgenpost on Tuesday, “but such connections cannot be ruled out.”<\/p>\n","protected":false},"excerpt":{"rendered":"Fraud Management & Cybercrime , Geo-Specific , Ransomware Extortion Group With Suspected Russian Provenance Imposes Friday Deadline David…\n","protected":false},"author":2,"featured_media":158103,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[99],"tags":[43047,74128,74116,74119,74118,74117,112,74125,74126,74127,190,74129,17419,74120,74123,74124,46413,74122,74121,74131,16916,74130],"class_list":["post-158102","post","type-post","status-publish","format-standard","has-post-thumbnail","category-berlin","tag-anti-money-laundering","tag-authentication","tag-bank-information-security","tag-bank-information-security-regulations","tag-bank-regulations","tag-banking-information-security","tag-berlin","tag-fdic","tag-fincen","tag-gao","tag-germany","tag-glba","tag-identity-theft","tag-information-security","tag-information-security-articles","tag-information-security-events","tag-information-security-news","tag-information-security-webinars","tag-information-security-white-papers","tag-phishing","tag-risk-management","tag-sarbanes-oxley-sox"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@dk\/117204081036265799","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/posts\/158102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/comments?post=158102"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/posts\/158102\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/media\/158103"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/media?parent=158102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/categories?post=158102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/dk\/wp-json\/wp\/v2\/tags?post=158102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}