Germany REFUSED To Pay Hackers 30 Bitcoin... And Paid A Heavy Price

Coin Bureau

766 views • 15 hours ago Save 9 min 4 min read

Video Summary

A ransomware group known as RiseSitter infiltrated Berlin's state government network, exfiltrating 5.8 terabytes of highly sensitive data, including confidential contracts, infrastructure details, and personal citizen information. Despite a demand for only 30 Bitcoin (approximately $2 million), Berlin refused to pay, prioritizing principle over a potentially false promise of data deletion. This decision led to the public release of the stolen data, exposing citizens' personal details and critical infrastructure vulnerabilities, and highlighting significant weaknesses in Germany's digital infrastructure.

The attack, which began with a sophisticated phishing tactic called "terminal fix" and was exacerbated by the storage of passwords in plain text files, impacted two key departments: urban development and transport. The breach crippled essential services, delaying payments for housing benefits and leaving citizens vulnerable to identity theft and phishing scams leveraging the leaked information. The incident underscores a broader pattern of slow digitization, fragmented security, and outdated practices within German public administration, as evidenced by previous cyberattacks on institutions like the British Library and Ireland's health service.

Short Highlights

Massive Data Breach: RiseSitter stole 5.8 terabytes of sensitive data from Berlin's government network.
Ransom Refused: Berlin refused to pay the 30 Bitcoin ransom, prioritizing principle.
Data Leaked Publicly: RiseSitter published the stolen data on its leak site.
Vulnerabilities Exposed: The attack revealed critical weaknesses in Germany's digital infrastructure, including plain-text passwords.
Citizen Impact: Personal data, contracts, and infrastructure details were exposed, leading to phishing risks.
Broader Pattern: Similar attacks on the British Library and Ireland's health service highlight a global issue.

Key Details

RiseSitter's Ransomware-as-a-Service Model [00:00:00]

RiseSitter operates as a franchise, with a core team providing ransomware and affiliates conducting breaches.
The "steal, lock, demand" model involves copying data, encrypting systems, and demanding payment.
Victims include the British Library, Chilean army, and hospitals in Portugal.

"This is what's known as ransomware as a service and the idea boils down to three words steal lock demand"

The Initial Breach: A Fake Captcha [00:02:00]

The attack began around August 7th with a fake captcha on a transport department employee's computer.
The employee was tricked into pasting a command into a Windows terminal, granting attackers access.
This tactic is known by Germany's federal cyber security agency as "terminal fix."

"Except this one asked them to paste a command into a windows terminal for some reason they did and the attackers were in"

Network Infiltration and Data Exfiltration [00:02:50]

Attackers exploited plain-text passwords stored in ordinary office files to move through the network.
The breach affected urban development, building and housing, and mobility, transport, climate protection departments.
Approximately 1.44 million files were copied by August 13th.

"And here the attackers got some help from the city in the form of passwords stored in plain text inside ordinary office files"

Berlin's Response and Refusal to Pay [00:03:40]

The intrusion was spotted on August 14th, and affected departments were disconnected from the network.
Essential services, including housing benefit processing, were stalled.
RiseSitter demanded 30 Bitcoin (around 2 million euros), but Berlin refused to pay on principle.

"The state of berlin will not be blackmailed"

Data Leak and Public Exposure [00:05:00]

After Berlin refused to pay, RiseSitter published the stolen data on its leak site.
A second batch of 550,000 files was released, including contracts, personnel records, and infrastructure analysis.
The leak exposed vulnerabilities in the city's water supply and other critical infrastructure.

"Contracts personnel and payroll records private phone numbers and home addresses caught and finding files and of course more of those plain text passwords"

Lingering Consequences and Systemic Issues [00:06:30]

The leaked data led to phishing scams targeting citizens with real file numbers.
The incident highlighted systemic issues: slow digitization, fragmented security, and outdated practices.
Previous attacks on the British Library and Ireland's health service underscore the recurring nature of these threats.

"But what do you think should governments ever pay or does refusing always cost more"