Berlin refuses to pay €2 million ransom after major cyberattack on city government
Berlin's mayor Kai Wegner declared on Friday that the German capital will not submit to blackmail after hackers demanded 30 bitcoins — equivalent to approximately €2 million — following a cyberattack that crippled city services two weeks ago.
The ransomware attack on August 14 left several city departments, particularly those handling housing and environmental matters, disconnected from the network for a week. Applications for housing benefits and payments were impossible to process for several days, affecting thousands of residents.
According to German weekly Der Spiegel, citing security sources, the hacker collective Rhysida is believed to be responsible for the attack. The group, which operates as a ransomware-as-a-service organization since emerging in May 2023, is known for targeting government institutions, healthcare facilities, and educational organizations across multiple countries using double extortion tactics that combine file encryption with threats to publish stolen data.
Scale of the breach revealed
Forensic investigations have revealed that data exfiltration from Berlin's Senate departments occurred between August 7 and August 12, a full week before the affected departments were disconnected from the network on August 14. The hackers claim on their dark web leak site to have stolen 5.79 terabytes of data encompassing roughly 1.44 million files from Berlin's government network.
Berlin authorities initially maintained that no sensitive data had been compromised, but on Wednesday admitted that personal information may have been affected. The ransom demand arrived early Thursday evening, according to Wegner, who stated firmly:
Berlin is the victim of a serious crime. Berlin will not give in to blackmail.
Precedent from British Library attack
The Berlin attack follows a similar pattern to Rhysida's October 2023 assault on the British Library, where the group demanded 20 bitcoins — worth approximately $850,000 at the time. When the library refused to pay, Rhysida released approximately 490,000 to 600,000 files totaling about 600GB of data on the dark web, including personal information of visitors, subscribers and staff. That attack exploited a third-party account on a Terminal Services server that lacked multi-factor authentication.
According to Der Spiegel, Rhysida has given Berlin one week to pay before threatening to publish the stolen data. Germany's security services are working intensively to apprehend the perpetrators, Wegner said, while authorities continue checking which data was compromised.
Growing ransomware threat
The Berlin attack occurs amid an escalating wave of ransomware targeting German institutions. Germany experienced nine confirmed ransomware attacks on government entities in the first half of 2026 alone, making it the second most targeted country globally after the United States, which recorded 58 attacks. Rhysida has already struck other German municipalities this year, including the Stuttgart city administration in May 2026.
In 2025, Germany's Federal Criminal Police Office recorded 1,041 ransomware attacks nationwide, representing a 10% increase from the previous year. Cyberattacks across the Germany-Austria-Switzerland region surged 124% overall during the same period.
Elections unaffected
The cyberattack comes less than a month before Berlin holds state elections on September 20, adding political sensitivity to the crisis. Deputy mayor Iris Spranger sought to reassure voters, stating that the cyberattack would not affect the electoral process.
The vote is 100 percent secure,
she emphasized.
The timing has raised questions about potential political motivations behind the attack, though authorities have not publicly commented on this aspect of the investigation.
