Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been stolen.
Berlin Mayor Refuses Extortion
Berlin Mayor Kai Wegner confirmed after a special Senate meeting that the state was facing an extortion attempt following the cyberattack. "The state of Berlin will not allow itself to be blackmailed," Wegner said. He did not publicly identify the attackers or disclose the amount demanded. Interior Senator Iris Spranger joined Wegner in briefing the public while authorities examined what information had left government systems.
Rhysida Claims Responsibility
German magazine Der Spiegel reported that the Rhysida ransomware group was behind the attack. The attackers demanded 30 BTC, worth roughly 2 million euros, and threatened to release stolen information if Berlin did not pay. Rhysida reportedly claimed to have taken almost six terabytes of data, including administrative offense proceedings, contracts, passwords, login credentials, emergency plans and documents related to critical infrastructure.
Two State Agencies Affected
The attack became public on Aug. 14 and affected Berlin's Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. Both agencies were temporarily disconnected from Berlin's state network. The separation lasted about a week and disrupted some administrative services, with residents temporarily unable to apply for housing benefits.
Ransomware and Cryptocurrency
Bitcoin and other cryptocurrencies have repeatedly featured in ransomware cases because attackers can direct payments to blockchain addresses without using conventional bank accounts. Rhysida emerged in 2023 and has been linked to attacks against government bodies, healthcare organizations and other institutions, including the British Library and the Chilean Army. In August 2025, U.S. authorities seized $1.09 million in cryptocurrency linked to the BlackSuit ransomware group. Berlin has not confirmed Rhysida's data claims, and the investigation remains active.
