Berlin: A ransomware group announced it will auction off a massive amount of data it stole from government agencies in Berlin, after city officials refused to pay the ransom.

According to National Iraqi News Agency, the group, Resida, which researchers say operates from Russia or Eastern Europe, stated on its website that it had seized 5.79 terabytes of data, including 46,500 contracts, as well as emails, phone numbers, passwords, and other confidential information. The group announced it will auction the data for a starting price of 30 bitcoins ($77,622) within seven days, displaying a countdown timer on its website.

The cyberattack was revealed in mid-August during a special session of the state government at the Red City Hall. Berlin Mayor Kai Wegener said the German capital had fallen victim to a “serious criminal act.” The cyberattack was revealed less than a month before the September 20 elections. The German broadcaster RBB reported that Berlin received ransom demands for an unspecified amount following the attack.

Berlin’s Senate Interior Committee member, Iris Spranger, told a press conference that officials could not provide details about the content or scope of the data breach because the extent of the intrusion was still being investigated. Spranger added that the city’s election infrastructure was unaffected, and according to security officials, no election-related data was compromised.

Data from the cybercrime research platform eCrime.ch indicates that Resida has claimed responsibility for approximately 280 attacks since its emergence in June 2023. Ransom-DB, a ransomware analysis and tracking service, shows that roughly half of the group’s victims are in the United States, followed by the United Kingdom, Canada, and Italy, among other countries. The group has repeatedly targeted government institutions, including hacking the British Library in October 2023. It has also claimed responsibility for attacks on the Chilean military, schools, healthcare facilities, and businesses of all sizes.