A named ransomware crew put a price on a city in bitcoin, lost the auction, and turned Berlin’s files into a public download.
The Rhysida Berlin bitcoin ransom clock died on Friday afternoon. The state refused a 30 bitcoin demand. Then the crew claimed to post stolen government data for anyone to take. German reporting puts the countdown’s end near 15:35 local time on September 4, 2026. The minimum bid had been framed as about €2 million. The city had already said it would not pay.
That is the strange thing about modern crypto scams and dark web crypto crime rails. The payment demand is a wallet address. The threat is a leak site. The “sale” is a countdown. When the clock dies unpaid, the theatre does not end. It widens.
What Rhysida Posted After the Auction Closed
On the group’s leak site, the auction listing flipped to a public-upload claim. heise and rbb reported the taunt. It told “data hunters” the files were now in the open section.
An early link returned an error. About an hour later, downloads became possible, according to heise’s update. rbb said roughly 1.4 million files appeared in multiple packages. Folders looked like personnel records, staff assessments, job references, and tender material. Checks on every folder’s authenticity were still incomplete in the same reporting window.
Chaos Computer Club spokesman Joachim Selzer told dpa the full dataset looked live for browsing. He described personnel matters and work references among the material. He warned that small office details can fuel identity theft once they sit in the open.
Berlin’s Senate said security officials and IT forensic teams were reviewing the published packages. Officials said people identified as affected would be notified under legal rules. Residents who suspected misuse should file a police report.
The Rhysida Berlin Bitcoin Ransom Demand and Refusal
Rhysida had marketed the haul as nearly 5.8 terabytes taken from Berlin’s state network. Earlier leak-site claims, summarized by heise and other German outlets, listed city contracts and fine cases. They also listed login material, personnel files, and papers touching critical systems and courts. Those catalogs were the group’s sales pitch, not a finished forensic inventory.
Governing Mayor Kai Wegner said Berlin would not be blackmailed. Senate spokeswoman Christine Richter had already told dpa the likely next steps were resale or partial or full publication. The state framed Rhysida as a professional ransomware outfit with prior hits across Europe and the United States. Officials said Russian links could not be ruled out. They also could not be proven from available findings.
The bitcoin ask mattered as infrastructure, not as a cultural metaphor. Thirty coins were the unlock condition. Refusal was the policy. The dark-web auction was the pressure chamber between those two facts.
How the Berlin Network Breach Unfolded
Berlin disclosed the attack on its state network around mid-August. Investigators later said large volumes of data were taken between August 7 and August 12. Hit systems were cut off for days. By late August, Rhysida’s auction and the 30 bitcoin floor were public. The Senate’s no-pay line became a governing message, not a private deal.
The Berlin public prosecutor’s office is in the response. So are the state criminal police (LKA) and the Federal Office for Information Security (BSI). That is the familiar ransomware choreography. Exfiltration comes first. Encryption or disruption is theatre. Then a leak site turns secrecy into a product. Single-incident crypto hack writeups explain how control was stolen. This story stays on the ransom rail and the dump.
Rhysida is not a new name on that stage. The same brand was linked to earlier public-sector and cultural targets, including high-profile cases abroad. This year it also hit other German cities. The Berlin episode fits the affiliate-era model. Steal enough that a government cannot quietly absorb the loss. Price the silence in bitcoin. Use the dark web as both marketplace and pillory.
Why the Dump Matters Beyond One City Network
Why did it matter? Because unpaid bitcoin ransoms do not erase the data. They change who can read it.
A private auction at least pretended to ration access. A public dump lowers the skill floor. Anyone with basic tools can copy the packages. Those files may hold signatures, payroll traces, internal mail, cleartext passwords, or notes the city never meant to publish. Selzer’s warning was practical. The more a stranger knows about a person, the easier it becomes to impersonate them. It also gets easier to order in their name, or craft a phishing lure that sounds local.
For crypto readers, the sequence is also a rail story. Crypto did not invent extortion. It made the demand portable, borderless, and easy to post beside a countdown. Leak sites then turned refusal into content. The city kept its policy. The parallel crime economy kept its inventory.
Security specialists quoted in German coverage praised the no-pay stance as a way to starve the model. They also said the dump still harms people whose files were never supposed to leave the network. Both can be true at once. That tension is the point.
The Real Story Beneath the Countdown
New tech changes the surface of crime. The underlying bargain stays old: threaten exposure, name a price, punish defiance in public.
Berlin’s case is now past the auction metaphor. The files are either ready to download or treated that way by investigators, reporters, and anyone else watching the same leak page. What remains is slower work. Match packages to real people. Rotate credentials. Watch for identity misuse. Decide which secrets were theatre and which were live ammunition.
Crypto did not create that dread. It gave it a wallet address, a dark-web storefront, and a Friday deadline. Rhysida used all three. Berlin declined the bid. The dump followed anyway.
Be the first to comment