30 Bitcoin or leak – ransomware gang extorts Berlin

The well-known ransomware group “Rhysida” is apparently behind the cyberattack on the Berlin Senate administration that became known in mid-August. They are demanding 30 Bitcoin from Berlin, currently worth around two million euros. If the state does not pay, extensive data sets totaling 5.8 terabytes are to be published.

As Spiegel reported on Friday evening, security circles had confirmed to the medium that the blackmailers are Rhysida. The criminals have been active for years and gained significant attention in 2023 when they attacked the British National Library. This year, the group attacked the city of Stuttgart, among others. The modus operandi is always the same: data is exfiltrated, followed by the extortion attempt.

However, Berlin does not want to pay. Even before the Spiegel report was published, an extraordinary meeting of the Berlin Senate took place on Friday, after which Governing Mayor Kai Wegner told the German Press Agency (dpa): “The state of Berlin will not be blackmailed.” The city had become the “victim of a serious criminal offense”, the CDU politician continued. Wegner did not want to elaborate on what Berlin was being blackmailed with. However, it could also involve personal data, the Governing Mayor added.

Severity of data difficult to assess

Spiegel then became more specific with reference to Rhysida’s leak site on the darknet. According to the group’s account, the data includes, among other things, 46,500 contracts from the city, 80,000 proceedings for administrative offenses, 6,000 files with unspecified “login data”, and other material. The documents allegedly in the possession of the blackmailers concerning Critical Infrastructure, emergency plans, and judicial matters are presumably particularly problematic. Based on the small excerpts of data already published, their sensitivity and authenticity cannot be immediately assessed.

The criminals were apparently prepared for the publication of their action. A countdown is currently running on their leak site until Friday of next week. According to dpa, it has been known in Berlin since last Thursday that this is an extortion attempt and that data has indeed been exfiltrated in a significant amount.

The Senate administration itself publicly announced in mid-August that its IT had been attacked. For over a week afterward, the compromised systems were taken offline. Another week later, it became known that the attacks had likely taken place much longer ago. From August 7th to 12th, according to the Senate, data was exfiltrated from the systems. The public prosecutor’s office and the Berlin State Criminal Police Office (LKA), as well as federal security authorities, are now investigating the cybercriminals.

(nie)