Berlin authorities are investigating a major cyberattack targeting two state agencies after hackers reportedly demanded 30 Bitcoin, worth around €2 million, in exchange for not publishing stolen government data.
Officials have made it clear that Berlin will not pay the reported ransom. However, authorities have not confirmed the exact amount demanded or verified claims that the attackers stole nearly six terabytes of sensitive information.
The ransomware group Rhysida has reportedly claimed responsibility for the attack, but the full scale of the breach remains under investigation.
Hackers Reportedly Demand 30 Bitcoin From Berlin
Berlin Mayor Kai Wegner confirmed following a special Senate meeting that the German capital was facing an extortion attempt connected to the cyberattack.
Wegner said Berlin would not give in to the attackers’ demands, making the government’s position on ransom payments clear.
German media reports have linked the attack to Rhysida, a ransomware group that has targeted governments, healthcare organizations and other major institutions since emerging in 2023.
According to reports citing information published on Rhysida’s dark web leak site, the attackers demanded 30 BTC and threatened to release stolen information if the payment was not made.
At the time, the Bitcoin ransom was valued at approximately €2 million.
However, Berlin authorities have not officially confirmed the 30 BTC figure.
Hackers Claim Nearly Six Terabytes of Data Were Stolen
Rhysida reportedly claims to have obtained almost six terabytes of information from Berlin government systems.
The group says the stolen material includes data from tens of thousands of administrative offense proceedings, contracts, passwords, login credentials, emergency plans and documents concerning critical infrastructure.
These claims have not been independently verified by Berlin authorities.
Initially, officials said the attackers had only accessed publicly available information. The government’s assessment later changed when the Senate Chancellery acknowledged that non-public data had also been affected.
Investigators are now working to establish exactly what information was accessed and how much data may have left government systems.
Two Berlin State Agencies Were Hit by the Cyberattack
The cyberattack became public on Aug. 14 and affected two major Berlin government agencies.
The first was the Senate Department for Urban Development, Building and Housing, while the second was the Senate Department for Mobility, Transport, Climate Protection and the Environment.
Both agencies were temporarily disconnected from Berlin’s state network as authorities attempted to contain the breach and prevent further unauthorized access.
The agencies remained separated from the network for around a week.
The disruption also affected some government services. German reports said residents temporarily faced problems applying for or receiving housing benefits while affected systems remained isolated.
Investigators are still trying to determine exactly when the attackers first entered the systems.
Reports connected to the investigation suggest information may have been extracted between Aug. 7 and Aug. 12, several days before officials discovered the attack.
German Authorities Continue Investigating the Breach
The Berlin State Criminal Police Office and prosecutors are investigating the incident.
State and federal security authorities are also working together to identify those responsible and determine which government files were accessed or removed.
Berlin Interior Senator Iris Spranger said the cyberattack had not compromised preparations for the city’s Sept. 20 state election.
According to Spranger, Berlin’s election infrastructure remains fully secured.
The Senate Chancellery has declined to provide detailed information about the hackers, ransom demand or potentially stolen information while the investigation remains active.
Officials say releasing those details could interfere with the ongoing investigation.
What Is the Rhysida Ransomware Group?
Rhysida emerged as a ransomware operation in 2023 and has since been connected to cyberattacks against government agencies, healthcare organizations and other institutions in multiple countries.
Previous targets reportedly include the British Library and the Chilean Army.
Like many ransomware operations, Rhysida’s strategy can involve stealing information before demanding payment.
Attackers can then threaten to publicly release the stolen data if victims refuse to meet their demands.
This technique creates additional pressure because organizations face not only disruption to their computer systems but also the possibility that confidential information could become public.
Why Ransomware Groups Demand Bitcoin
Bitcoin and other cryptocurrencies frequently appear in ransomware attacks because payments can be sent directly between blockchain addresses without relying on traditional bank transfers.
However, Bitcoin transactions are not completely anonymous.
Bitcoin operates on a public blockchain, meaning transactions between addresses can be viewed and traced.
Blockchain forensic companies and law enforcement agencies can analyze transaction histories, identify patterns and sometimes connect cryptocurrency addresses with exchanges, services or individuals.
Authorities have successfully recovered cryptocurrency connected to ransomware operations in previous investigations.
Authorities Have Recovered Crypto From Previous Ransomware Attacks
In August 2025, U.S. authorities seized approximately $1.09 million in cryptocurrency linked to the BlackSuit ransomware operation.
The enforcement action also included the seizure of four servers and nine domains.
BlackSuit had reportedly been connected to more than 450 known U.S. victims and over $370 million in ransom demands since 2022.
In one case, a victim paid 49.3 BTC following a 2023 cyberattack. Investigators later recovered part of that cryptocurrency payment.
Another U.S. investigation involved an alleged member of the Scattered Spider hacking group.
Federal prosecutors charged 19-year-old Peter Stokes in connection with an alleged corporate cyber intrusion and an unsuccessful attempt to demand an $8 million cryptocurrency ransom.
According to the U.S. Justice Department, attacks associated with Scattered Spider had resulted in more than $100 million in ransom payments.
Attackers linked to the group allegedly used methods including phishing and impersonating employees while contacting corporate help desks.
Berlin Has Not Verified Rhysida’s Claims
Despite reports linking Rhysida to the Berlin cyberattack, several important details remain unconfirmed.
Berlin authorities have acknowledged that non-public information was affected, but they have not confirmed Rhysida’s claim that nearly six terabytes of data were stolen.
Officials have also not publicly verified the reported 30 BTC ransom demand or the full list of sensitive documents the ransomware group claims to possess.
The investigation is therefore focused on establishing both the extent of the breach and the identity of those responsible.
For now, Berlin’s position remains unchanged: the government will not give in to the reported Bitcoin ransom demand while state and federal authorities continue investigating the cyberattack.
