Berlin Tells Rhysida to Get Lost After 5.7TB Data Heist

Berlin isn't paying. The German capital made that clear on Friday, flatly refusing to meet the demands of the ransomware group that broke into city systems earlier this month and walked off with an eye-watering amount of data.

The breach hit the Senate Department for Mobility, Transport, Climate Protection, and Environment, and was flagged on August 14. That same day, officials pulled the plug on the department's network, along with that of the Senate Department for Urban Development, Construction, and Housing, in an attempt to stop the bleeding.

According to statements from governing mayor Kai Wegner and the Senate Chancellery, the actual data theft happened between August 7 and 12. Personal and non-public information was likely caught up in it, though Berlin isn't saying much beyond that, pointing to an active investigation involving state and federal law enforcement and the public prosecutor's office.

On Friday, Wegner and interior senator Iris Spranger confirmed a ransom demand had been received. They also confirmed the city won't be paying it.

Berlin hasn't officially named the attackers, but Rhysida has done that job themselves. The ransomware group added Berlin to their Tor-based leak site on August 28, claiming responsibility and listing what they say they took: more than 5.7 terabytes of data.

The alleged haul is substantial. Rhysida claims to have lifted legal documents, financial records, HR files, contracts, passwords stored in plaintext, payroll data, passport and ID information, IBAN payment details, lawsuit case files, and leadership personal data. They also claim personal information on over 12,000 individuals, more than 16,000 email addresses, and nearly 12,000 phone numbers.

For all of this, the group wants 30 bitcoin, roughly $2.3 million at current rates.

Berlin's position is firm. Whether Rhysida publishes the data now is the next question.