Berlin Rejects 30 Bitcoin Ransom as Hackers Leak Data

Berlin's state government declined to pay a ransom of 30 bitcoin, and the attackers subsequently released 5.7 terabytes of stolen information on the dark web.

The Rhysida ransomware gang set the auction starting price at 30 bitcoin. Berlin allowed the deadline to lapse and did not make a payment.

Reasons Behind the Rejected Bitcoin Ransom

Active since 2023, the Rhysida ransomware group put the stolen files up for auction to the highest bidder, starting at 30 bitcoin.

Bitcoin (BTC) trades near $79,902 per coin, making 30 coins worth approximately $2.4 million. Berlin's Senate Chancellery estimated the ransom demand at roughly two million euros.

BTC has gained 0.46% today and 24.4% over the past month. This increase pushed the dollar value of the ransom higher during the ultimatum period.

Florian Hauer, Berlin's chief digital officer, stated that no payment would be made.

"The State of Berlin will not give in to blackmail. The safety of the State of Berlin’s staff and the people of Berlin is our top priority."

The deadline for the bitcoin ransom passed on Friday, September 4. That afternoon, Rhysida released the complete data set.

Berlin's stance follows a wider trend. On-chain ransomware payments decreased by roughly 8% in 2025, while reported attacks rose by 50%.

Berlin Assesses Damage After Dark Web Auction

The cyberattack came to light on August 14. Berlin subsequently disconnected two Senate departments from the state network: one responsible for urban development and housing, and the other for mobility, transport, and the environment.

Housing benefit payments and family support were disrupted until both departments were reconnected on August 23. Authorities have cautioned that residents' personal information may be included in the leaked data.

A central crisis team is now examining the material that Rhysida published after the bitcoin ransom went unpaid. Forensic experts are analyzing the files continuously.

The investigation is led by the State Criminal Police Office and Germany's federal cybersecurity agency. Officials have advised residents to report any fraud or identity theft to the police.

Berlin's residents will vote for a new state parliament on September 20, two weeks after the bitcoin ransom deadline passed.

Rhysida received no payment. Berlin has not estimated the damage, and the review of the leaked files is ongoing.