Berlin’s state government has refused to pay a ransom demand of 30 Bitcoin from the Rhysida ransomware group, resulting in the public release of 5.7 terabytes of stolen data. The deadline for payment expired on September 4, after which the attackers published the full dataset on the dark web that same afternoon.

The ransom was valued at roughly $2.4 million based on Bitcoin trading near $79,902 per coin at the time. Berlin’s Senate Chancellery had assessed the demand at approximately $2.3 million. Officials chose not to negotiate or make any payment.

Official Stance Against Payment

Florian Hauer, Berlin’s chief digital officer, confirmed the decision against compliance with the extortion attempt.

Rhysida, a ransomware operation active since 2023, had initiated an auction for the compromised files with an opening bid of 30 BTC. When no payment arrived by the September 4 cutoff, the group released the material.

Details of the August Breach

The cyberattack was first detected on August 14. In response, Berlin disconnected two Senate departments from the state network. One oversees urban development and housing. The other handles mobility, transport, and environmental affairs.

The disconnection disrupted certain public services. Housing benefit payments and family support programs experienced delays until both departments were restored to the network on August 23. Authorities have cautioned that personal data belonging to Berlin residents may form part of the leaked files.

A central crisis unit is now examining the released material. Forensic cybersecurity specialists are reviewing the 5.7 terabytes of data continuously to identify the scope of the compromise and potential risks.

Ongoing Investigation and Public Guidance

The State Criminal Police Office and Germany’s federal cybersecurity agency are leading the probe into the incident. Officials have advised residents to contact police if they encounter signs of fraud or identity theft that may connect to the breach.

No financial payment reached Rhysida. Berlin has not released an estimate of the overall financial or operational damage caused by the attack. Analysis of the published data continues as the city prepares for a state parliamentary election scheduled for September 20.

The refusal aligns with a wider pattern in which ransomware payments have declined. On-chain payments related to such attacks fell by about 8 percent in 2025, even as the number of claimed attacks increased by 50 percent.