Rhysida claimed to have stolen 5.7 terabytes of information—this amounts to 1.44 million files. The ultimatum deadline expired on September 4, after which part of the stolen data was published. On September 6, the attackers published another batch of data containing login credentials and passwords for accessing the Berlin administration's databases.
Officials believe the stolen information may contain passport data of government employees and city residents, as well as corporate documentation of legal entities. The Berlin authorities still do not know exactly which individuals and organizations have been affected.
The tabloid Bild reported that secret documents concerning the capital's infrastructure were also stolen, including information on emergency response, as well as data related to defense industry enterprises, the Bundeswehr (German armed forces), the police, prisons, and engineering infrastructure.
The Rhysida hacker group has been active since mid-2023 and specializes in ransomware attacks. Rhysida primarily targets government institutions, critical infrastructure facilities, medical and educational organizations, and large enterprises. Typically, the attackers encrypt the stolen data and offer to sell it back, and in some cases, they sell it to other hackers.
A year ago, the group put confidential data stolen from the transportation department of the US state of Maryland up for sale. The extortionists demanded a ransom of 30 bitcoins (approximately $3.4 million).
In 2024, the Rhysida extortionists carried out an attack on Seattle International Airport, demanding 100 bitcoins for stolen passenger information. However, the airport refused to pay the hackers.
end-content
