Berlin Refuses to Pay Extortion Group Over Data Theft Claims

Post Views: 9

Berlin has confirmed it will not pay a ransom demanded by a cybercriminal group following a data breach that exposed sensitive information.

Overview of the Data Breach

The capital city of Germany confirmed it will not comply with the ransom demands of a cybercriminal group that infiltrated its network and exfiltrated significant volumes of data earlier this month. The breach was first detected on August 14 and affected the Senate Department for Mobility, Transport, Climate Protection, and Environment. As part of containment measures, the department’s network was suspended on the same day, along with the network of the Senate Department for Urban Development, Construction, and Housing.

Timeline of the Breach

Official statements from Mayor Kai Wegner and the Senate Chancellery indicated that the data breach occurred between August 7 and 12, involving the unauthorized extraction of personal and non-public information. The city has not disclosed further details about the incident, citing an ongoing investigation led by state criminal police, federal security agencies, and the public prosecutor’s office.

Ransom Demands and City’s Response

On Friday, Wegner and Senator for the Interior and Sport Iris Spranger reiterated that the attackers had requested a ransom but emphasized the city’s decision to reject the payment. While the specific threat actor responsible for the attack has not been officially identified, the Rhysida ransomware group has claimed responsibility for the breach.

Ransom Amount and Claims

The group temporarily listed Berlin on its Tor-based data leak platform on August 28, asserting the theft of over 5.7 terabytes of data. The stolen data reportedly includes complaints, legal documents, financial records, contracts, human resources files, passwords, and confidential materials. Rhysida alleged the exposure of personal information for more than 12,000 individuals, along with 16,000 addresses and nearly 12,000 phone numbers.

Details of the Stolen Data

Additional compromised data included payment details such as IBANs, plaintext credentials, lawsuit case files, payroll information, passport and ID documents, leadership private data, and other sensitive records. The group demanded a ransom of 30 Bitcoin, equivalent to approximately $2.3 million.

Impact and Cybersecurity Implications

The incident highlights the growing threat of ransomware attacks targeting critical infrastructure and the challenges faced by organizations in balancing financial considerations with cybersecurity policies. The city’s refusal to pay the ransom aligns with broader guidelines from cybersecurity authorities advising against funding criminal operations.

Ongoing Investigations and Next Steps

Investigations into the breach remain ongoing, with no further updates provided at this time. The city’s decision to reject the ransom underscores its commitment to cybersecurity best practices and the prevention of future threats.