The Rhysida ransomware group, active since 2023, demanded a ransom of 30 BTC from the Berlin state government. With Bitcoin trading near $79,902, the demand was valued at approximately $2.4 million, while Berlin's Senate Chancellery estimated it at about €2 million.
The city's chief digital officer, Florian Hauer, rejected the payment, stating that the state would not give in to blackmail. After the deadline expired on Friday, September 4, the hackers published 5.7 terabytes of stolen data on the dark web.
The attack, which surfaced on August 14, led to the disconnection of two Senate departments: urban development and housing, and mobility, transport, and the environment. This caused delays in housing benefit payments and family support until the departments returned to the network on August 23.
The State Criminal Police Office and Germany's federal cybersecurity agency are leading the investigation. A central crisis unit and forensic specialists are reviewing the leaked files, as officials have warned residents that their personal data may be compromised.
