As the investigation into the Berlin cyberattack deepens, Mayor Kai Wegner said the capital’s administration will not bow to the hackers’ ransom demand. Wegner said some of the city’s systems were breached at the start of the month, data was stolen, and the blackmail demand was delivered on Thursday evening.

Wegner said, "Berlin will not give in to blackmail."

According to reports in the German press, the attackers are demanding 30 bitcoin, worth about €2 million. While city authorities have not officially disclosed the amount, state police, prosecutors and federal security units said they are accelerating the investigation to identify the suspects.

Officials said the first data leak took place between August 7 and 12. Then, on August 14, networks belonging to two departments were shut down; as a result, applications for housing assistance and related payments could not be processed for several days. Subsequent forensic examinations also detected additional data leaks in Berlin’s transport and environment administration.

The city administration said it could not rule out the possibility that the affected data includes personal or otherwise non-public information. The review of which files were accessed and the full extent of the data breach is still ongoing.

Reports have said the attack was claimed by the Rhysida group, which is believed to have links to Russia and Eastern Europe. According to Reuters, the group said on its website that it would auction 5.79 terabytes of data it claims to have stolen from Berlin within seven days. A screenshot published by Der Spiegel reportedly showed contracts, non-disclosure agreements, staff files, passwords and thousands of personal contact details in the group’s possession.

Rhysida is said to have targeted numerous public institutions and companies since 2023. That same year, the group infiltrated the British Museum’s systems; when the institution refused to pay the ransom, the stolen files were published on the dark web. The Berlin attack came about a month before local elections in the city. State Senator Iris Spranger said the election infrastructure was not affected by the incident.