Berlin Rejects $2 Million Bitcoin Ransom, Hackers Release 5.7 TB of Data

Berlin’s state government refused to pay a ransom of 30 Bitcoin, roughly €2 million, after the Rhysida ransomware group stole and threatened to release a large dataset. The deadline expired on September 4, and the attackers posted the 5.7 TB of data on the dark web.

Ransom demand and refusal

Rhysida, active since 2023, opened an auction for the stolen files with a starting bid of 30 BTC. At the time, Bitcoin traded near $79,902, valuing the demand at about $2.4 million. Berlin’s Senate Chancellery estimated the amount at roughly €2 million. Florian Hauer, Berlin’s chief digital officer, publicly stated that the state would not give in to blackmail.

Impact on state services

Following the breach, two Senate departments—urban development and housing, and mobility, transport, and the environment—were disconnected from the state network. This disruption delayed housing benefit payments and family support until the departments were restored on August 23.

Investigation and response

A central crisis unit, forensic specialists, the State Criminal Police Office, and Germany’s federal cybersecurity agency are reviewing the leaked material. Residents have been advised to report any fraud or identity theft to the police.

Broader context

On‑chain ransomware payments have fallen about 8 % in 2025, even as reported attacks have risen 50 %. Berlin’s refusal aligns with a growing trend of authorities rejecting ransom payments.