Berlin's state government refused a 30 Bitcoin ransom worth approximately $2.4 million, leading to the publication of 5.7 terabytes of stolen state data on the dark web. According to reports, the Rhysida ransomware group had opened the auction at 30 BTC, with Bitcoin trading near $79,902 per coin at the time. The Bitcoin ransom deadline expired on Friday, September 4, after which Rhysida published the full dataset. The breach specifically affected two Senate departments on August 14, causing significant disruptions to public services.
Berlin's Senate Chancellery had valued the demand at approximately two million euros, but city officials ruled out any payment. As reported by the city's chief digital officer Florian Hauer, "The State of Berlin will not give in to blackmail. The safety of the State of Berlin's staff and the people of Berlin is our top priority." The attack caused housing benefit payments and family support to stall until both affected departments returned to the state network on August 23. This incident highlights a growing trend where victims are increasingly refusing to pay ransom demands.
A central crisis unit now reviews the material Rhysida released following the unpaid ransom. According to reports, the State Criminal Police Office and Germany's federal cybersecurity agency lead the investigation, with forensic specialists combing through the files around the clock. Officials have warned residents that their personal data could be in the leak and advised them to report fraud or identity theft to police. The breach affected housing and transport departments, causing delays in benefits and services across the state.
The Bitcoin ransom demand failure aligns with broader industry trends, as on-chain ransomware payments fell about 8% in 2025 despite claimed attacks rising 50%. As reported, BTC has added 0.46% today and 24.4% over the past month, raising the dollar value of the demand while the ultimatum ran. Berliners elect a new state parliament on September 20, two weeks after the Bitcoin ransom expired, with the state not yet putting a figure on the total damage from the attack.
