Berlin rejects Rhysida ransomware blackmail, braces for Friday deadline

September 2, 2026 at 05:00 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Berlin officials detected a Rhysida ransomware attack on Aug. 14 and disconnected all Senate departments from the central network. The attackers demand 30 bitcoins by Friday and threaten to publish 5.79 terabytes of stolen data. Berlin mayor Kai Wegner said the city will not give in to blackmail.

Key Facts

Rhysida demands 30 bitcoins from Berlin and threatens to publish stolen data by Friday.
The attack was detected on Aug. 14, and all Berlin Senate departments were disconnected from the central network.
Berlin mayor Kai Wegner admitted that public and non-public data may have been taken between Aug. 7 and Aug. 12.
Rhysida claims to hold 5.79 terabytes of Berlin Senate data, including 16,389 emails and 11,963 phone numbers.
Berlin Senate spokeswoman Christine Richter reiterated at a Tuesday press conference that the city would not pay.

Attack Detection and Response

The attack was detected on Aug. 14, and all departments of the Berlin Senate were immediately disconnected from their central network. Affected departments included urban development, construction and housing, causing significant disruptions for housing benefit claimants, and mobility, transport, environment and climate protection. Berlin officials temporarily canceled remote work and are scouring all their systems. Berlin mayor Kai Wegner initially said no sensitive data appeared to have been compromised, but by last Friday admitted that public and non-public data may have been taken between Aug. 7 and Aug. 12.

Rhysida's Demands and Claims

The ransom demand came in early on Thursday evening, according to Wegner, who said Berlin will not give in to blackmail. Rhysida wants 30 bitcoins from Berlin and says it will publish the data if it doesn't get the cryptocurrency by this coming Friday. The group claims to have 5.79 terabytes of Berlin Senate data, including 16,389 emails, 11,963 phone numbers, 148 banking codes, tens of thousands of contracts and judicial documents, and thousands of personnel files. Rhysida also says it took credentials stored in plaintext, along with classified materials and vulnerability analyses of Berlin's water supply. The group is running an auction until Friday, claiming it will only give the data to one buyer.

Rhysida's Track Record

Rhysida is a prolific outfit that often targets organizations in the United States, with multiple American healthcare providers among its victims. A Ransom-DB analysis in February found that almost half of its known attacks landed elsewhere in the world, with Europe featuring strongly. The group targeted the German city of Stuttgart in May, demanding 5 bitcoin in payment for data it claimed to have stolen, although neither the theft nor any ransom payment have been publicly confirmed. Rhysida employs the now-standard tactic of double extortion, threatening leaks and the ongoing encryption of data on the victim's systems.