The city of Berlin has been targeted in a cyberattack claimed by the hacking group Rhysida, which says it extracted several terabytes of data from the German capital's systems.
Rhysida is demanding a ransom of 30 bitcoin, worth approximately 2 million euros at current prices, in exchange for not releasing the stolen material. The group has threatened to auction the data on the dark web if the payment is not made.
The use of a fixed bitcoin sum rather than a euro figure is typical of ransomware operations, which rely on the cryptocurrency's pseudonymous transfer mechanism to collect payments while avoiding conventional banking channels that could be monitored or frozen by authorities.
A familiar playbook
Ransomware groups such as Rhysida have increasingly targeted public institutions across Europe, betting that the disruption caused by withheld or leaked municipal data will pressure victims into paying rather than risk the exposure of sensitive records. The threat to auction stolen files on the dark web is a common escalation tactic, designed to create urgency and to signal that the data has resale value to third parties beyond the original attackers.
The scale of the alleged theft, several terabytes, points to a broad intrusion into Berlin's systems, though the brief does not specify which departments or categories of data were affected.
Bitcoin's role in this case follows a pattern seen in ransomware incidents worldwide, where the cryptocurrency is used as the settlement mechanism of choice precisely because it can be moved across borders without the involvement of traditional financial intermediaries. For European authorities, incidents of this kind renew scrutiny of how ransom payments in cryptocurrency can be traced, seized or discouraged, an issue that has featured repeatedly in discussions around law enforcement cooperation and blockchain forensics.
No further details have been provided about the identity of the systems breached, the timeline of the attack, or whether Berlin authorities intend to engage with the ransom demand. The city has not issued a public response addressing the claims made by Rhysida.
