Berlin Rejects 30 BTC Ransom as Hackers Leak 5.7TB of Data

Berlin’s state government refused to pay a 30 Bitcoin ransom demanded by the Rhysida ransomware group, prompting the hackers to release 5.7 terabytes of stolen data on the dark web.

Rhysida, a ransomware operation active since 2023, attempted to auction the compromised files with bidding starting at 30 BTC. With Bitcoin trading near $79,902, the ransom was worth roughly $2.4 million, or about €2 million according to Berlin’s Senate Chancellery.

Berlin officials allowed the September 4 payment deadline to expire rather than negotiate with the cybercriminals. Florian Hauer, Berlin’s chief digital officer, said the government would not submit to blackmail and emphasized that protecting state employees and residents remained the priority.

After receiving no Bitcoin payment, Rhysida published the stolen dataset on Friday afternoon.

The ransomware attack was first detected on August 14 and forced Berlin to disconnect two Senate departments from the state network. The affected agencies oversee urban development and housing, as well as mobility, transport and environmental affairs.

The disruption temporarily affected government services, including housing benefit payments and family support. Both departments were reconnected to the state network on August 23.

Officials have warned that personal information belonging to Berlin residents may be among the leaked files. A central crisis unit and forensic cybersecurity specialists are now reviewing the massive dataset to determine what information was compromised and assess the potential consequences.

Berlin’s State Criminal Police Office and Germany’s federal cybersecurity agency are investigating the cyberattack. Authorities have advised residents who encounter suspected fraud or identity theft linked to the breach to contact police.

Berlin’s decision comes as ransomware victims increasingly resist cryptocurrency payment demands. On-chain ransomware payments reportedly declined around 8% in 2025 despite a 50% increase in claimed attacks.

Rhysida ultimately received no ransom from Berlin, but the financial and security impact of the 5.7TB data breach remains unclear. Authorities continue to analyze the leaked information ahead of Berlin’s September 20 state parliamentary election.