Berlin’s state government has confirmed it is being extorted following the breach of the city’s administrative network in August — and said it will not pay. Governing Mayor Kai Wegner told reporters after an emergency Senate session that “the state of Berlin is being blackmailed,” while the Senate Chancellery stated that the attack has been referred to the state criminal police, the public prosecutor, and federal security authorities. Der Spiegel, citing an entry on the group’s dark-web leak site and security sources involved in the response, named Rhysida as the group responsible. The Hacker News confirmed the attribution independently via a leak-site monitoring service: an entry titled “Berlin, Germany” appeared on Rhysida’s site on August 28, claiming 5.79 terabytes of data across roughly 1.44 million files, with 12,076 individuals’ personal information reportedly among the contents.
The Berlin Senate Chancellery’s statement also disclosed new forensic details: investigators found additional data outflows from the Senate Department for Mobility, Transport, Climate Protection and Environment, with exfiltration dated between August 7 and August 12 — a week before the department was isolated from the city network on August 14. Personal or other non-public data cannot be excluded from the stolen material, the chancellery said, and the scope and content are still being examined. No ransom figure appeared in Rhysida’s leak-site post. CISA, the FBI, and MS-ISAC have published a joint advisory on Rhysida (AA23-319A) documenting the group’s typical initial access methods: valid accounts on external-facing remote services (particularly VPNs without MFA), exploitation of the Zerologon privilege escalation bug (CVE-2020-1472), and phishing.