Ransomware group posts stolen sensitive files after Berlin refuses to pay

The Rhysida hacking group has published more than 5.8 terabytes of data it says it stole from the state of Berlin after the city’s senate refused to pay a ransom.

The group claims the haul contains about 1.44 million files, including personnel documents, payroll records and confidential material from committees of Germany’s Federal Council. It also claimed to have obtained usernames and passwords for government databases and payment providers, as well as analyses of vulnerabilities in Berlin’s drinking-water supply.

Rhysida demanded 30 bitcoin, worth about 2 million euros, in exchange for keeping the files private. It gave Berlin seven days to pay. When the deadline expired on Friday afternoon, the group uploaded the stolen material to the dark web, a separate part of the internet where activity is harder to trace.

Authorities said they were contacting people affected by the breach and were examining the files. Their authenticity had not yet been confirmed.

Rhysida has been linked to several cyberattacks in the United States and Europe and is believed to operate from Russia and Eastern Europe. The group was previously blamed for a cyberattack on the British Museum. German reporting said the attackers were not currently believed to be connected to a foreign state or political organization and were thought to be financially motivated, although possible links to the Russian state could not yet be ruled out.