The “Berlin” hack, although quite prominent, is just a single event in a continuous stream of attacks by different groups against all kinds of targets — banks, schools, hospitals, cities, …
This is a real industry, moving huge amounts of money.
And no – BTC (Bitcoin) is not the problem. With Bitcoin, every transaction is recorded on the blockchain, which makes it possible to “follow the money”. By paying in FIAT (like Dollar, Euro..) those traces can be much harder to follow.
Recently it became known that the hacker group “Rhysida” infiltrated the Berlin internal network and downloaded some 5TB of data.
Rhysida demanded 30 BTC in exchange for deleting the stolen data – Berlin did not pay, so the data appeared on the darkweb. While there was a lot of talk in the news about this, the leaked data itself was not shown. So the public could not see what by then already publicly available data actually had been leaked. Since it sometimes is a bit tricky to find the right addresses on the darkweb I show you here the target:
If you download and use a TOR Browser , you can see for yourself at these addresses:
URL,Type,Status,Date,PageTitle
http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/,DLS,inactive,2026-09-05,Rhysida
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/,DLS,inactive,2026-09-05,Rhysida
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php,DLS,inactive,2026-09-05,
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?auction,DLS,inactive,2026-09-05,
http://rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion,FS,inactive,2026-01-05,Onionsite Not Found
http://rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion,FS,inactive,2026-01-06,Onionsite Not Found
http://rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion,FS,inactive,2026-09-05,Onionsite Not Found
Sometimes they are reachable, sometimes not..
(Btw: the hacker group also claims to have hacked “Stuttgart”, another major city in germany. The data itself show “only” a hack of a housing company “GVV”)
On the front page, you can see the group’s current auctions and victims. Berlin shows this info:
This exploit seems to work against “ZIMBRA” ; some CVE were published on 28.8.26 This attack here might be related to CVE-2026-73570, an unauthenticated command injection vulnerability via specially crafted SMTP requests which is currently being actively exploited. I have not verified that this particular attack actually uses CVE-2026-73570.
