
Germany REFUSED To Pay Hackers 30 Bitcoin... And Paid A Heavy Price
- In summer 2023, the ransomware group Rhysida (also linked to Ryuk) breached the network of Berlin's state government.
- The attackers stole 5.8 terabytes of sensitive data, including personnel records, contracts, infrastructure plans, and citizens' data.
- They demanded 30 Bitcoin (around €2 million) as ransom.
- The entry point was a fake CAPTCHA: An employee was tricked into running a terminal command that executed malware.
- The attackers were further helped by plaintext passwords stored in Office documents – a massive security failure.
- Two administration departments were affected: Urban Development and Mobility, Transport, Climate Protection, and Environment.
- Governing Mayor Kai Wegner stated: "Berlin will not be blackmailed."
- The city refused to pay because doing so would not guarantee the deletion of the data and would finance further attacks.
- The deadline passed, and Rhysida published the stolen files in several batches.
- The leak contained highly sensitive information, including salary slips, home addresses, case files, and even vulnerability analyses of the city's water supply.
- Germany's cybersecurity agency BSI warned about phishing emails using real file numbers derived from the leaked data.
- The processing of benefits such as housing subsidies came to a temporary standstill.
- As early as 2019, Berlin's Kammergericht was infected with the Emotet malware – with similarly drastic consequences.
- Berlin's state network is operated separately by different authorities, weakening overall security.
- Germany missed its own deadline to digitalize public services (OZG) by 2022.
- British Library: Rhysida stole 600 GB and published the data after the library refused to pay.
- Ireland: The national health service HSE was hit by Conti; the entire IT network had to be shut down.
- Anhalt-Bitterfeld district: A cyberattack paralyzed local government and triggered the first-ever disaster declaration due to a cyber incident in Germany.
The attack highlights how vulnerable public institutions are when outdated structures meet highly professional extortionists. Refusing to pay was politically understandable but came at a significant cost to those affected. The question remains: Should governments ever pay, or is standing firm the only viable long-term solution?





