The Rhysida ransomware group infiltrated Berlin's state government systems last week, stealing 1.44 million files totaling approximately 5.8 terabytes of sensitive data. German officials condemned the attack as an extremely serious crime targeting the nation's capital.
The breach occurred when hackers exploited vulnerabilities in the government's network infrastructure, gaining access to confidential documents spanning multiple departments. Authorities discovered the intrusion during routine security monitoring and immediately launched an investigation with federal cybercrime units. The attackers subsequently published portions of the stolen data online, escalating concerns about national security implications.
Cybercriminals demanded 30 bitcoins—worth roughly $3 million at current exchange rates—for the return of the compromised information. When officials refused to negotiate, Rhysida began releasing batches of documents through dark web channels and public file-sharing platforms. Security researchers noted the group's methodical approach, suggesting months of reconnaissance preceded the actual exfiltration phase.
Federal prosecutors have opened terrorism-related charges against the perpetrators, citing potential threats to democratic institutions. International cooperation efforts involve Europol and the FBI, though tracking cryptocurrency transactions remains challenging. Experts warn similar attacks could target other European governments given the operation's apparent success.
The incident has prompted emergency legislative sessions in Berlin to strengthen cybersecurity protocols across all public agencies. Finance Minister Christian Lindner announced a €500 million emergency fund for digital infrastructure upgrades, emphasizing that protecting citizen data takes absolute priority. Meanwhile, affected individuals face heightened risks of identity theft and social engineering schemes using the leaked information.
How did the Rhysida group gain access to government systems? Investigators believe hackers exploited unpatched software vulnerabilities in remote access portals, allowing them to move laterally through network segments over several weeks before detection.
What type of information was compromised in the breach? Stolen files include internal correspondence, budget documents, personnel records, and correspondence between government officials and citizens, though classified materials reportedly remained protected.
Will the German government pay the ransom demand? Chancellor Olaf Scholz's office confirmed they will not negotiate with cybercriminals, aligning with national policy against funding terrorist organizations through digital extortion schemes.