Berlin Government Faces 30 BTC Ransom Demand After Cyberattack

The Berlin city government has become the target of a significant cyberattack, with the perpetrator group demanding a substantial cryptocurrency ransom. According to reports from German media outlets ZEIT and Der Spiegel, the attackers have requested 30 Bitcoin (approximately 2 million Euros) in exchange for not releasing sensitive data stolen from state systems. While the breach occurred roughly two weeks ago, the specific details regarding the compromised information and the identity of the attackers have only recently begun to surface as investigations continue.

Rhysida Group Linked to Infrastructure Breach

The cybercriminal organization known as Rhysida, a group with a documented history of high-profile digital extortion, is suspected of orchestrating the breach. The attack primarily targeted Berlin's traffic and construction management departments, which were promptly isolated from the broader state government network to prevent further lateral movement by the hackers.

Rhysida is known in the cybersecurity community for deploying ransomware that encrypts files and threatens public disclosure of data to pressure victims into payment.

The data at risk is believed to include:

• Internal processing records related to traffic violations.
• Administrative login credentials and passwords.
• Sensitive documents from the city's construction planning sector.

Government Response and Investigation Strategy

Despite the threat of data exposure, the Berlin state government is maintaining a firm stance against the extortionists. Berlin Mayor Kai Wegner has addressed the situation, emphasizing that the city will not be coerced into making illicit payments.

Berlin will not yield to blackmail.

Currently, state officials have declined to provide a full assessment of the data breach scope or confirm the exact ransom amount for "investigation strategy reasons." Law enforcement agencies and digital forensics experts are currently working to secure the IT infrastructure and determine the exact path of entry used by the attackers.

In conclusion, the incident underscores the growing trend of ransomware-as-a-service groups targeting critical municipal infrastructure to demand high-value assets like Bitcoin. As Berlin refuses to negotiate, the focus shifts to data recovery and the reinforcement of cybersecurity protocols to mitigate the impact of the potential information leak.