Berlin State Government Refuses 30 Bitcoin (BTC) Ransom Over 5.8TB Leak

Hackers Publish 5.8TB of Stolen Files

Roughly 1.44 million files weighing 5.8 terabytes, taken from Berlin's state administrative network, have been dumped online after the city government turned down a ransom demand of 30 Bitcoin (BTC), a sum worth about €2 million at the Bitcoin (BTC) price when the attackers set it. The hackers had listed Berlin on their leak site in late August and named September 4 as the payment deadline. When that date passed without a transfer, the stolen material went public, and the following night about 550,000 more files were added. The cache spans contracts, personnel and payroll records, private phone numbers and home addresses of civil servants and residents. It also includes a vulnerability analysis of the city's water utility infrastructure. Germany's Federal Office for Information Security (BSI) warns that phishing emails quoting real case numbers from the stolen files are already circulating. A message carrying a genuine file identifier is far harder to dismiss than a generic fraud attempt. Berlin has set up a dedicated contact email and an information page, and several hundred people have made inquiries. No on-chain settlement tied to the extortion has been identified so far. The case fits a wider pattern of Bitcoin-denominated extortion against institutions, where the payment rail matters less than the impossibility of verifying what attackers do with their copies. That verification problem is the hinge of the affair, because a government that pays cannot confirm deletion. Berlin chose refusal and is now managing the consequences file by file.

From Fake Screen to Full Breach

The intrusion began with a social engineering trick, not a software flaw. On August 7, an employee in Berlin's transport department was shown a counterfeit security authentication screen instructing them to prove they were human by pasting commands into the Windows terminal, and following those instructions handed the attackers their foothold. Movement inside the network was then straightforward, because passwords had been stored unencrypted in ordinary work documents. The attack spread across two departments: urban development, building and housing, and transport, climate and environment. Administrators detected the breach on August 14 and split both departments off from the administrative network, a step that disrupted email, shared documents and the processing of housing benefits. The extortion phase followed a familiar sequence: the attackers named a date and waited. Mayor Kai Wegner stated publicly that “Berlin does not bow to threats.” The logic against payment runs along two lines: copied data can be sold regardless of any deletion promise, and public funds channeled to criminals would likely finance the next operation. Bitcoin's design sharpens both points, because as a proof-of-work network its transactions settle without intermediaries and cannot be reversed once confirmed, leaving a payer no recourse if the counterparty breaks its word. Berlin has been here before on a smaller scale: in 2019 the city's higher regional court was hit by malware, cut from the network, and 150 judges and 370 staff worked by phone, fax and post for months. Authorities admitted at the time that security fell short of required standards. The shared-network structure with per-department security management remains the structural weakness behind both incidents.

30 BTC Was Never the Point

COINOTAG's reading: Berlin's refusal was economically rational and sets a template other administrations can copy. A demand of 30 Bitcoin (BTC), about €2 million at the time, is a rounding error next to crypto whale wallets, so the sum was never the real cost; the precedent of paying would have been. The sharper near-term exposure sits with residents, who face phishing built on genuine case numbers. Governments otherwise touch Bitcoin as a strategic Bitcoin reserve asset or not at all; extortion demands are the unwelcome third channel. Spot markets slipped 3.4% over the last 24 hours on broader flows, unrelated to the Berlin case. The number the piece opened with still stands: 5.8 terabytes of public records remain public, and the staged release suggests more may follow.