Berlin authorities' principled stance led to a massive data leak: the Rhysida hacker group, having failed to receive the demanded 30 BTC ransom, released 5.7 terabytes of stolen information into the public domain. This decision has become an important precedent in the confrontation between the state and cybercriminals.
Let me recall the timeline of events. The attack on Berlin's senate departments responsible for urban development, housing, transport, and the environment occurred on August 14. Attackers from Rhysida — a group actively operating since 2023 — put the stolen data up for auction with a starting price of 30 bitcoins.
At the time of the incident, this demand was estimated at approximately $2.4 million (with BTC trading around $79,900) or €2 million. However, given the volatility of the leading cryptocurrency, which has risen 24.4% over the past month, the dollar value of the ransom only increased during the ultimatum period.
Why Berlin refused to pay
The city's head of digital administration, Florian Hauer, categorically ruled out the possibility of any payments. His stance was firm: "The State of Berlin will not give in to blackmail. The safety of employees and city residents is our top priority."
The ultimatum deadline expired on Friday, September 4. On the same day, Rhysida published the full archive of stolen data. Berlin's refusal is not just a one-off story but a reflection of a global trend: according to analysts' estimates, cryptocurrency ransom payments to extortionists declined by approximately 8% in 2025, even despite a 50% increase in the number of attacks.
Consequences for the city
Immediately after the attack, two senate departments were disconnected from the government network. Housing benefit payments and family assistance had to be suspended until August 23, when the agencies resumed operations. Officials warned that the leak could have affected residents' personal data.
Currently, the Central Crisis Task Force is checking the published files around the clock, and forensic experts are examining them for potential fraud. The investigation is being conducted by the State Criminal Police Office and Germany's Federal Office for Cybersecurity. Residents are strongly advised to report any cases of identity theft.
Notably, new elections for Berlin's state parliament will take place on September 20 — just two weeks after the ultimatum expired. Rhysida ultimately ended up with nothing, and the total damage amount for the city has not yet been disclosed.
My expert view: Berlin's decision is a strategically sound move, despite the immediate reputational and operational costs. Yielding to bitcoin ransom demands only finances and encourages further criminal activity. However, authorities should learn a lesson: such attacks on critical infrastructure require preventive measures, not just heroic resistance after the fact. The incident once again underscores that cryptocurrency anonymity remains a key tool for cybercriminals, and regulators will need to find effective levers of influence.