Berlin Refuses 30-Bitcoin Ransom After Ransomware Leak

Berlin refused to pay a 30-Bitcoin ransom after the Rhysida ransomware group published 5.7 terabytes of stolen files on the dark web. Rhysida opened an auction with a starting bid of 30 BTC; the deadline expired on September 4 with no payment.

The intrusion was detected on August 14. Berlin disconnected two Senate departments from the state network — urban development and housing, and mobility, transport and the environment. The isolation interrupted housing benefit payments and family support; both departments were reconnected on August 23.

At the time of the auction Bitcoin traded near $80,000 per coin, putting the ransom at about $2.4 million. The Senate Chancellery reported the demand at roughly two million euros. Bitcoin’s price rise increased the dollar value while the auction was running.

Florian Hauer, Berlin’s chief digital officer, wrote that the state “will not give in to blackmail. The safety of the State of Berlin’s staff and the people of Berlin is our top priority.” After the deadline, Rhysida posted the full dataset on the dark web on the afternoon of September 4.

A central crisis unit is reviewing the released files. Forensic teams are examining the data continuously. The State Criminal Police Office and Germany’s federal cybersecurity agency are leading the investigation. Officials warned the leak may include residents’ personal information and urged anyone who suspects fraud or identity theft to report it to the police.

Berlin has not provided an overall estimate of financial or administrative damage. Rhysida reported no payment was received. Voters are scheduled to elect a new state parliament on September 20, two weeks after the ransom deadline expired.

Industry trackers reported that on-chain ransomware payments fell by about 8% in 2025 even as the number of claimed attacks rose roughly 50%.