The Berlin government has refused to yield to the Rhysida ransomware gang demanding a 30 Bitcoin ransom, valued at roughly 2 million euros. Berlin Mayor Kai Wegner stated unequivocally that the state will not allow itself to be blackmailed, taking an absolute stance even as nearly 6 terabytes of government data remains in the hands of the hackers.
The cyberattack immediately crippled two key institutions: the Department for Urban Development and the Department for Mobility. To limit the damage, authorities were forced to disconnect both departments from the main state network for approximately a week. The impact was felt directly by the public - daily administrative services ground to a halt, leaving the processing of citizens’ housing benefit applications stalled.
A Shifting Narrative
Initial reports from the city government claimed that the hackers had only accessed public data. However, that statement was later retracted. Authorities acknowledged that non-public data had also been exfiltrated to the attackers’ servers.
Claims from Rhysida detailed a far worse scenario. The group claimed to have copied tens of thousands of sensitive documents, ranging from administrative infraction files, draft contracts, password lists and login credentials, to emergency contingency plans and critical city infrastructure details. The entire data exfiltration process occurred silently between August 7 and August 12. Security authorities only detected the breach on August 14, 2026.
Amid the ongoing investigation, Senator Spranger provided assurances regarding upcoming schedules, guaranteeing that infrastructure for the upcoming September 20 election remains secure from the hackers and will proceed as normal.
Threat Actor Profile and Crypto Patterns
Rhysida’s decision to use Bitcoin as a ransom vehicle highlights standard operating procedures for ransomware syndicates. Crypto assets enable perpetrators to direct payments to blockchain addresses without undergoing compliance screenings or facing account freezes from conventional banks.
The Rhysida group is not a new player. They are the same syndicate behind high-profile attacks on major institutions such as the British Library and the internal network of the Chilean Army.
Despite their recurrence, multi-million-dollar ransom demands do not always end in full payouts. U.S. law enforcement seized $1.09 million in cryptocurrency from BlackSuit group operations in August 2025. In a separate case, the Scattered Spider group also failed to force a victim to pay an $8 million ransom demand.
Data in Limbo
Berlin’s decision to refuse the 30 Bitcoin ransom closes the door on negotiations, but does not eliminate the risk of a leak. The heaviest burden now weighs on city residents and departmental employees. Without a payout, it is only a matter of time before tens of thousands of personal records and access credentials are dumped online.
Source: crypto.news.
Read also: UK Police Seize 20 Bitcoin from 2016 Darknet Ring - Culprit Deceased, but Evidence Endures
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
