Berlin’s state government has refused to pay a 30 Bitcoin ransom demanded after a cyberattack, and the Rhysida ransomware group has since published 5.7 terabytes of stolen data on the dark web. Officials said the demand amounted to about €2 million, while the dollar value was roughly $2.4 million based on Bitcoin trading near $79,902 per coin.

The data release followed the expiry of Rhysida’s deadline on September 4. Berlin said it would not negotiate, even as authorities warned that personal information belonging to residents could be included in the leaked material.

Deadline passed without payment

Rhysida, a ransomware group active since 2023, had offered the stolen files for sale to the highest bidder and opened the auction at 30 BTC. Rather than meet the demand, Berlin allowed the deadline to lapse.

Florian Hauer, the city’s chief digital officer, said the state would not yield to blackmail and described the safety of Berlin’s staff and residents as the priority. After the deadline expired on Friday, September 4, the group published the full dataset later that day.

Attack disrupted two Senate departments

The cyberattack first became public on August 14. In response, Berlin disconnected two Senate departments from the state network: the department responsible for urban development and housing, and the one covering mobility, transport, and the environment.

The outage disrupted public services. Housing benefit payments and family support were paused until both departments were reconnected on August 23. Berlin has not provided an estimate of the overall damage caused by the incident.

Authorities review leaked files

Officials have said that residents’ personal data may be among the files Rhysida released. A central crisis unit is now examining the published material, and forensic specialists are reviewing the data continuously.

The investigation is being led by the State Criminal Police Office together with Germany’s federal cybersecurity agency. Authorities have also told residents to contact police if they detect fraud or signs of identity theft.

Broader ransomware backdrop

Berlin’s decision not to pay reflects a wider trend cited in the source material. On-chain ransomware payments fell by about 8% in 2025 even though claimed attacks increased by 50%.

For now, Rhysida appears to have received no payment from Berlin. The review of the leaked files is still ongoing, and the next confirmed step remains the continuing forensic and police investigation as the city assesses what information was exposed.

Source: beincrypto.com