Ransomware group claims to have stolen government data from Berlin and put it up for auction

A ransomware group announced on Friday that it would auction off a massive trove of data stolen from government agencies in Berlin, after city officials refused to pay the ransom.

The ResiDa group, which researchers say operates from Russia or Eastern Europe, stated on its website that it had seized 5.79 terabytes of data, including 46,500 contracts, as well as email addresses, phone numbers, passwords, and confidential information.

The group announced it would put the data up for auction with a starting bid of 30 Bitcoin ($77,622) within less than seven days, displaying a countdown timer on its website.

The cyberattack on Berlin’s network comes less than a month before the city’s elections on September 20.

In a joint statement on Friday, Kai Wegner, Berlin’s mayor, and Iris Spranger, Berlin’s Senator for the Interior, said, “The State of Berlin will not succumb to extortion,” before the ransomware group claimed responsibility for the attack on its website.

Wegner said at a press conference that officials could not provide details about the content or scope of the stolen data because the full extent of the breach is still under investigation.

Spranger stated that the city’s election infrastructure had not been affected, and according to security officials, no election-related data had been compromised.

Data from the eCrime.ch cybercrime research platform indicates that ResiDa has claimed responsibility for approximately 280 attacks since it emerged in June 2023.

The group has repeatedly targeted government institutions, including breaching the British Library in October 2023. It has also claimed responsibility for attacks on the Chilean military, schools, healthcare facilities, and companies of various sizes.