Berlin rejects 30‑Bitcoin ransom after cyberattack on state agencies

Berlin’s Senate Chancellery confirmed that the state will not pay a ransom demanded by a ransomware group after a cyberattack disrupted two government departments. The attackers allegedly asked for 30 BTC, roughly €2 million at current prices, and threatened to publish stolen data.

Attack details

The breach was discovered on 14 August and affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. Both agencies were disconnected from the state network for about a week, causing temporary service interruptions such as delays in housing benefit applications.

Ransom demand and response

The ransomware group identified as Rhysida claimed to have exfiltrated almost six terabytes of data, including administrative proceedings, contracts, passwords, login credentials, emergency plans and critical‑infrastructure documents. Berlin officials have not verified the volume or content of the alleged theft and have declined to comment on the specific demand, stating that the state will not be blackmailed.

Investigation status

State and federal security agencies, including the Berlin State Criminal Police Office and prosecutors, are investigating the intrusion. Authorities have not disclosed details about the attackers, the exact data taken, or whether the 30 BTC demand was confirmed. The Senate Chancellery noted that non‑public information was compromised, revising an earlier statement that only publicly available data had been affected.

Broader context

Rhysida, active since 2023, has previously targeted government bodies, healthcare institutions and cultural organizations in several countries. The use of Bitcoin for ransomware payments continues to attract law‑enforcement attention, as blockchain transactions can be traced despite the anonymity of cryptocurrency wallets.