Berlin state IT attacked with ransomware: Rhysida demands two million dollars in Bitcoin

Evidence published online

The Senate Chancellery stated that the state of Berlin was not prepared to pay the demanded ransom. Instead, it would rely on the ongoing investigations of the responsible authorities and further strengthen IT security. According to the information, the background of the attack and the exact extent of the data theft are still being investigated.

According to information from the Senate Chancellery, Berlin's Governing Mayor Kai Wegner informed about the incident and the measures initiated. Interior Senator Iris Spranger has also been involved, according to the state Ministry of the Interior. In addition, the IT service provider of the state of Berlin has been involved in restoring the systems and analyzing the incident.

Response from the Senate Chancellery

The ransomware group Rhysida has, according to findings by IT security researchers, previously attracted attention with large-scale attacks on public institutions and companies. The group typically uses the principle of double extortion: data is not only encrypted, but additionally copied beforehand, in order to increase the pressure on those affected.

The attack on Berlin's state IT is part of a series of similar incidents at German authorities and municipal administrations. In Stuttgart and other cities, public bodies have also been targets of ransomware campaigns in recent years. Security experts have long warned that the IT security of many administrations is not at the level required to withstand professional attackers.

Rhysida as a known attacker group

The Berlin Senate Chancellery announced that the incident would be reviewed transparently and that the public would be informed of further findings. At the same time, it said, it was being examined which personal data is specifically affected. Should it be confirmed that data of citizens has been exfiltrated, the state of Berlin will inform those affected through the legally prescribed notification channels.

IT security experts emphasize that, in the case of ransomware attacks, administrations must fundamentally weigh a rapid restoration of operations against the question of ransom payment. A payment does not guarantee the return of the data and can also provoke further attacks. The recommendation of most authorities, including the Federal Office for Information Security (BSI), is not to pay any ransom.

For the Berlin administration, the incident means a considerable additional workload in IT security and possibly also restrictions in ongoing operations. Which specific services are affected and how long the restoration will take was initially unclear. The Senate Chancellery referred to the ongoing investigations.

Consequences for the administration

Berlin's data protection commissioner Bianca Kastl could, according to the assessment of legal experts, be involved in the case, since personal data may be affected. The exact responsibilities are currently being coordinated between the authorities, according to the Senate Chancellery.