Berlin probes cyberattack as hackers demand 30 Bitcoin for stolen data

cryptonews08-31 17:25

Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2663907983?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-31 17:25","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2663907983","market":"other","top_or_hot":-1,"title":"Berlin probes cyberattack as hackers demand 30 Bitcoin for stolen data","media":"cryptonews","content":"<div>\n<p>Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been ...</p>\n\n<a href=\"https://crypto.news/berlin-probes-cyberattack-as-hackers-demand-30-bitcoin-for-stolen-data/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Berlin probes cyberattack as hackers demand 30 Bitcoin for stolen data</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBerlin probes cyberattack as hackers demand 30 Bitcoin for stolen data\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-31 17:25 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/berlin-probes-cyberattack-as-hackers-demand-30-bitcoin-for-stolen-data/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been ...</p>\n\n<a href=\"https://crypto.news/berlin-probes-cyberattack-as-hackers-demand-30-bitcoin-for-stolen-data/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"SBIT","symbol_name":"2倍做空比特币期货ETF-Proshares","start_time":0,"source_url":"https://crypto.news/berlin-probes-cyberattack-as-hackers-demand-30-bitcoin-for-stolen-data/","article_id":"2663907983","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/berlin-probes-cyberattack-as-hackers-demand-30-bitcoin-for-stolen-data/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2663907983","pubTimestamp":1788168355,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been stolen.Hackers reportedly demanded 30 Bitcoin, worth roughly 2 million, after a cyberattack affected two Berlin state agencies.The attackers threatened to publish stolen information, while Berlin officials have refused to pay and have not confirmed the reported ransom amount.Berlin initially said only public information was compromised but later acknowledged that non-public data had been affected.Rhysida reportedly claimed responsibility for the attack and said it obtained sensitive files, though Berlin authorities have not verified the full extent of the alleged theft.The Berlin Senate Chancellery said it would not disclose details about the attackers, their demands or the information potentially taken from government systems while the investigation remains active. A Senate spokesperson told ","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"SBIT":"2倍做空比特币期货ETF-Proshares","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","BITI":"1倍做空比特币期货ETF-Proshares","STCE":"Schwab Crypto Thematic ETF","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","BTC":"Grayscale Bitcoin Mini Trust","WFH":"Direxion Work From Home ETF","BITO":"比特币期货ETF-ProShares","SPAM":"THEMES CYBERSECURITY ETF","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","BTCC":"Grayscale Bitcoin Covered Call ETF","FBTC":"比特币ETF-Fidelity","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","OOQB":"One+One Bitcoin and Ether ETF","IBIT":"比特币ETF-iShares","BRRR":"比特币ETF-CoinShares","EZBC":"比特币ETF-Franklin","BPI":"Grayscale Bitcoin Premium Income ETF","09042":"华夏比特币-U","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","09439":"嘉实比特币-U","ARKB":"比特币ETF-21Shares","BITU":"2倍做多比特币期货ETF-Proshares","DEFI":"比特币期货ETF-Hashdex","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","GBTC":"比特币ETF-Grayscale","UCYB":"ProShares Ultra Nasdaq Cybersecurity ETF","BTCO":"比特币ETF-Invesco Galaxy","BITX":"2倍比特币期货ETF-Volatility Shares","09008":"博时比特币-U","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BCCC":"Global X Bitcoin Covered Call ETF","BTRN":"比特币期货ETF-Global X","BTCW":"比特币ETF-Wisdom Tree","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BTYB":"VistaShares BitBonds 5 Yr Enhanced Weekly Distribution ETF","BITB":"比特币ETF-Bitwise","HODL":"比特币ETF-VanEck","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April"},"translate_title":"柏林调查网络攻击，黑客要求 30 个比特币窃取数据","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"CBXO":0.6,"UCYB":0.65,"BFJL":0.6,"CBTA":0.6,"HECO":0.65,"OOQB":1.5,"BTYB":1.5,"BITO":0.6,"09008":1.5,"CBOA":0.6,"WFH":0.65,"QBF":0.6,"SPAM":0.65,"BRRR":0.6,"BITY":0.6,"BPI":0.6,"BTC":0.6,"SBIT":0.6,"CBXY":0.6,"XBTY":0.6,"09439":1.5,"CBXJ":0.6,"BTCW":0.6,"CBXA":0.6,"EZBC":0.6,"BTRN":0.6,"ARKB":0.6,"BITU":0.6,"BAGY":0.6,"BTCC":0.6,"BFAP":0.6,"BTCO":0.6,"BITI":0.6,"CBTO":0.6,"CBTY":0.6,"DEFI":0.6,"CBOJ":0.6,"CBOO":0.6,"BCCC":0.6,"GBTC":0.6,"CBOY":0.6,"STCE":0.74,"DFII":0.6,"09042":1.5,"BITB":0.6,"FBTC":0.6,"IBIT":1.5,"HODL":0.6,"BITX":0.6},"content_text":"Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been stolen.\n\n\nSummary\n\n\n\nHackers reportedly demanded 30 Bitcoin, worth roughly €2 million, after a cyberattack affected two Berlin state agencies.\nThe attackers threatened to publish stolen information, while Berlin officials have refused to pay and have not confirmed the reported ransom amount.\nBerlin initially said only public information was compromised but later acknowledged that non-public data had been affected.\nRhysida reportedly claimed responsibility for the attack and said it obtained sensitive files, though Berlin authorities have not verified the full extent of the alleged theft.\n\n\n\nThe Berlin Senate Chancellery said it would not disclose details about the attackers, their demands or the information potentially taken from government systems while the investigation remains active. A Senate spokesperson told German news agency dpa that officials could not comment “for investigative reasons” at this stage.\nThe position leaves several details of the attack unconfirmed by the state government, including reports that the ransomware group Rhysida obtained sensitive files and threatened to publish them unless Berlin paid roughly 2 million euros in Bitcoin.\nBerlin has refused the reported 30 Bitcoin demand\nBerlin Mayor Kai Wegner confirmed after a special Senate meeting on Friday that the state was facing an extortion attempt following the cyberattack.\n\n“The state of Berlin will not allow itself to be blackmailed,” Wegner said.\n\nHe did not publicly identify the attackers or disclose the amount demanded. Interior Senator Iris Spranger joined Wegner in briefing the public following the meeting, while authorities continued examining what information had left government systems.\nGerman magazine Der Spiegel reported that Rhysida was behind the attack, citing information posted by the ransomware group on its dark web leak site. Security sources cited by the publication reportedly identified Rhysida as the group responsible for the extortion attempt.\nThe attackers demanded 30 BTC and threatened to release the information if Berlin did not pay, according to the report. At current prices, the demand was worth roughly 2 million euros.\nRhysida reportedly claimed to have taken almost six terabytes of data. The alleged files include information from tens of thousands of administrative offense proceedings, contracts, passwords, login credentials, emergency plans and documents related to critical infrastructure.\nBerlin authorities have not independently confirmed the amount of data claimed by the group or the full list of compromised records.\nThe distinction has become important to the official account of the incident because the government’s assessment changed after the attack was discovered. Officials initially said only publicly accessible information had been taken before the Senate Chancellery acknowledged last Wednesday that non-public data was affected.\nCyberattack forced two Berlin agencies off the state network\nThe attack became public on Aug. 14 and affected Berlin’s Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment.\nBoth agencies were temporarily disconnected from Berlin’s state network as officials worked to contain the incident.\nThe separation lasted for about a week and disrupted some administrative services. German reports said residents were temporarily unable to apply for or receive housing benefits while the affected systems remained isolated.\nInvestigators are still determining when the intrusion began and how much information left the network. Reports citing the investigation said data may have been extracted between Aug. 7 and Aug. 12, several days before officials detected the attack.\nThe Berlin State Criminal Police Office and prosecutors are investigating the breach. Wegner said state and federal security authorities were working to identify the perpetrators while officials continued checking which files had been accessed or removed.\nSpranger said the attack had not compromised preparations for Berlin’s Sept. 20 state election, describing the election infrastructure as fully secured.\nThe ransomware case follows another government cyberattack involving a Bitcoin demand reported by crypto.news in July. Hackers took control of Kenyan President William Ruto’s official website and demanded 5 BTC while threatening to disclose unspecified information.\nKenyan authorities temporarily restricted access to the website and opened an investigation. The country’s ICT Authority said at the time that investigators had found no evidence that sensitive information had been accessed, stolen or lost.\nRhysida has operated as a ransomware group since 2023\nRhysida emerged in 2023 and has been linked to attacks against government bodies, healthcare organizations and other institutions in several countries.\nThe group has previously targeted organizations including the British Library and the Chilean Army. Its operations generally combine network intrusion with demands for payment, while the threat of publishing stolen information can be used to pressure victims.\nBitcoin and other cryptocurrencies have repeatedly featured in ransomware cases because attackers can direct payments to blockchain addresses without using conventional bank accounts.\nPublic blockchain transactions can still be followed. A crypto.news report on blockchain forensics detailed how investigators can trace cryptocurrency movements between addresses and use transaction patterns and other information to connect funds with services or individuals.\nLaw enforcement agencies have recovered cryptocurrency from ransomware operations in previous cases. In August 2025, U.S. authorities seized $1.09 million in cryptocurrency linked to the BlackSuit ransomware group alongside four servers and nine domains.\nBlackSuit had been linked to more than 450 known U.S. victims and over $370 million in ransom demands since 2022. One victim paid 49.3 BTC in 2023 after an attack, with investigators later recovering part of the payment, according to the Justice Department.\nA separate U.S. case in July involved a suspected member of the Scattered Spider hacking group. Federal prosecutors charged 19-year-old Peter Stokes over an alleged corporate intrusion and an unsuccessful $8 million cryptocurrency ransom demand.\nThe Justice Department said Scattered Spider-linked intrusions had resulted in more than $100 million in ransom payments, with attackers using techniques including phishing and impersonating employees when contacting corporate help desks.\nBerlin has not confirmed Rhysida’s data claims\nBerlin’s investigation remains focused on establishing the extent of the breach while the government withholds details that officials say could affect the inquiry.\nRhysida’s claims about the stolen material originate from the group’s dark web communications and have not been fully verified by the Berlin government. Officials have confirmed that non-public information was affected, reversing the initial assessment that the compromised material was limited to publicly accessible data.\nThe Senate Chancellery has not disclosed whether investigators have verified the reported 30 BTC demand, the nearly six terabytes allegedly taken or the individual categories of information Rhysida claims to possess.\nWegner said authorities at the state and federal levels were working to identify the group responsible, while the Berlin State Criminal Police Office and prosecutors continued their investigation into the attack.\n\n\n\n\n\n                Read more:\n            \n\n                Zcash private transactions could fall below 200ms","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.48.0","shortVersion":"4.48.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2663907983","isCrawlerRequest":true}