Berlin confirms data theft after Rhysida ransomware attack claims

Berlin’s city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site.

The attack was discovered in mid-August, and the threat actor claimed it publicly last Friday, on August 28.

Kai Wergner, the Mayor of Berlin, stated that the city will not pay the attacker, and the State Criminal Police Office, the public prosecutor's office, and federal security agencies are now investigating the incident.

Rhysida ransomware has been active since mid-2023, targeting healthcare organizations, state governments, education institutes, and critical infrastructure.

The threat actor claims to have exfiltrated 5.79 TB of data, comprising approximately 1.44 million files, from Berlin’s administrative network.