World

Berlin is being blackmailed by hackers, mayor says

BBC World · 2026-08-28

AI SUMMARY

• What happened: Berlin's mayor confirmed that the city is being blackmailed by hackers who infiltrated city systems and stole data, leading to a ransom demand from the Rhysida group for 30 bitcoin (approximately €2 million). • Why it matters: The cyber attack has disrupted essential city services, including housing benefit applications, and raised concerns about the potential exposure of personal data, highlighting vulnerabilities in cybersecurity for government institutions. • What to watch next: Investigations are ongoing to assess the extent of the data breach and identify the perpetrators, while city officials are focused on ensuring the security of Berlin's systems, especially with upcoming elections.

**Berlin Under Cyber Attack: Mayor Confirms Ransom Demand from Hackers**

Berlin, Germany – The city of Berlin is currently facing a significant cyber threat, as hackers have successfully infiltrated city systems and stolen data, according to Mayor Kai Wegner. The attack, which occurred earlier this month, has led to a ransom demand that city officials are refusing to meet.

On Thursday evening, the hackers, identified as the Rhysida group, issued a ransom demand. While the exact amount has not been disclosed by the mayor, reports from Der Spiegel indicate that the hackers are seeking 30 bitcoin, equivalent to approximately €2 million (£1.7 million). Mayor Wegner emphasized that Berlin would not yield to the demands, stating, "Berlin will not be blackmailed."

The cyber attack has had immediate repercussions, forcing the shutdown of several online systems within the city. This disruption has particularly affected applications for housing benefits and payments, which were rendered inoperable for several days following the attack. Investigations are ongoing to determine the extent of the data breach and the specific information that may have been compromised.

The Rhysida group, believed to operate from Russia and Eastern Europe, has previously been linked to cyber attacks on various institutions, including a notable incident involving the British Museum. In that case, the group stole approximately 500,000 files and published them on the dark web after the museum declined to pay the ransom.

In the case of Berlin, the Rhysida group claims to have stolen 5.79 terabytes of data and has announced plans to auction this information on their dark web site within a week. The auction is set to begin with a starting price of 30 bitcoin, mirroring the ransom demand made to the city.

Authorities in Berlin, including state police, prosecutors, and federal security services, are actively investigating the attack and working to identify the perpetrators. Mayor Wegner noted that inquiries into the "content and scope of the compromised data are being pursued with great intensity." Initial investigations revealed that the data leak occurred between August 7 and August 12, with further leaks identified in the transport and environment department.

The mayor's office has acknowledged that personal or non-public data may be among the compromised information, raising concerns about the potential impact on residents. As the investigation continues, city officials are focused on understanding the full extent of the breach and ensuring the security of Berlin's systems.

This cyber attack comes at a critical time for Berlin, as the city is set to hold elections in the coming month. However, state senator Iris Spranger has assured the public that the election infrastructure has not been compromised by the attack.

The Rhysida group has gained notoriety since its emergence in 2023, claiming responsibility for numerous cyber attacks targeting government institutions and businesses worldwide. As the situation unfolds, Berlin's response to this cyber threat will be closely monitored, both for its implications on city operations and the broader context of cybersecurity in Europe.

As investigations continue, city officials are urging residents to remain vigilant and report any suspicious activity related to their personal data. The incident highlights the growing challenges posed by cybercrime and the importance of robust security measures to protect sensitive information in an increasingly digital world.

Source: BBC World
RELATED NEWS

More Stories

All News
World

Footage of Tibet floods isn't being shown in China - and we know little about victims there

• What happened: Severe flash floods hit Gyirong Port on the Nepal-Tibet border, causing significant destruction and loss of life, with hundreds reported missin...

World

Ebola spreads to two new zones in DRC; 60 areas now affected

• What happened: The Ebola outbreak in the Democratic Republic of the Congo (DRC) has spread to two new health zones, bringing the total to 60 affected areas, w...

World

With the US and Canada locked in a trade war, fears of a recession lurk

• What happened: The trade war between the US and Canada escalated as the US imposed 50% tariffs on $20 billion worth of Canadian goods, prompting Canada to ret...

World

Before and after images show catastrophic impact of Nepal flash floods

• What happened: Catastrophic flash floods in Nepal have resulted in nearly 600 deaths and over 2,400 people reported missing, with significant destruction of c...

World

RSS chief’s US visit faces protests over Hindu nationalism

• What happened: Mohan Bhagwat, chief of the Rashtriya Swayamsevak Sangh (RSS), is scheduled to speak in New York, prompting protests from human rights groups c...

World

8-year-old Nepal flood survivor reunited with mother after rescue

• What happened: An 8-year-old boy named Zoyal Ghale was rescued after surviving devastating floods in Nepal, where he fled into a forest and climbed trees to e...