Berlin Rejects $2.3 Million Ransom Demand from Rhysida Hackers After Data Theft

BERLIN — The city government of Berlin has refused to pay a ransom demand of 30 bitcoin, approximately $2.3 million, following a cyberattack by the Rhysida extortion group that resulted in the theft of more than 5.7 terabytes of data from municipal networks.

The incident involves critical infrastructure managed by the Senate Department for Mobility, Transport, Climate Protection, and Environment, as well as the Senate Department for Urban Development, Construction, and Housing. Rhysida claimed responsibility for the breach on Monday, August 31, 2026, stating that it had exfiltrated sensitive information and would proceed with public release unless the payment was made within a specified timeframe.

City officials confirmed the refusal to negotiate or pay the demanded sum. The decision aligns with broader German government policies discouraging ransom payments to cybercriminal groups, which authorities argue fund further illicit activities and do not guarantee data deletion. Despite the refusal, the city has activated emergency protocols to assess the scope of the compromised information and mitigate potential operational disruptions across transport and urban development sectors.

The stolen data volume, exceeding 5.7 terabytes, suggests a significant intrusion into internal systems. While officials have not specified exactly which documents were accessed, the departments involved handle sensitive records related to public transit logistics, climate protection initiatives, housing projects, and construction permits. Rhysida has historically targeted government entities and critical infrastructure, often leveraging stolen data to pressure victims into compliance.

In a statement released shortly after the ransom demand was made, city representatives emphasized that the safety of citizens and the integrity of public services remain the top priority. Technical teams are currently working to isolate affected systems, restore operations from secure backups, and conduct a forensic analysis to determine the entry point used by the attackers. No immediate service outages were reported at the time of disclosure, though officials warned that some administrative processes could face temporary delays.

The Rhysida group has indicated it will begin publishing portions of the stolen data online if the ransom is not paid. This threat raises concerns about potential exposure of personal information belonging to residents and employees, as well as strategic planning documents related to Berlin's long-term urban development. Security experts note that such leaks can have lasting reputational and financial consequences for municipal agencies.

As of Monday afternoon, no payment had been made, and the deadline for the ransom demand remains a focal point of the developing situation. Authorities have not yet commented on whether law enforcement agencies are actively investigating the group's digital footprint or if international cooperation is underway to trace the perpetrators. The city continues to monitor the situation closely as the threat of data publication looms.