Germany REFUSED To Pay Hackers 30 Bitcoin... And Paid A Heavy Price

Berlin Government Network Breach

A ransomware group breached parts of Berlin’s state government network after an employee was tricked by a fake CAPTCHA that prompted them to run a command. The attackers reportedly used passwords stored in ordinary office files to move through the network.

The attackers copied about 5.8 terabytes of data—roughly 1.44 million files—from two Senate departments. Berlin disconnected the departments from the state network, disrupting email, shared documents, casework, and housing-benefit processing.

Ransom Demand and Data Leak

The group demanded 30 Bitcoin, then worth about €2 million. Berlin refused to pay, with Mayor Kai Wegner declaring that the city would not be blackmailed. Officials argued that paying would fund criminals and provide no reliable assurance that the data would be deleted.

After the deadline passed, the attackers published stolen files, followed by another batch of roughly 550,000 files. The exposed material reportedly included:

• Personnel and payroll records
• Addresses and phone numbers
• Contracts and case files
• Passwords
• Information about vulnerabilities in water infrastructure

Germany’s information-security authority warned that scammers were using details from the leaked files to make phishing messages more convincing. Berlin created a contact email address and webpage for affected people. Authorities advised them to watch for identity theft and report suspicious activity.

Wider Cybersecurity Concerns

The video presents the breach as part of a wider problem: Berlin’s public-sector systems are fragmented across departments, security practices are weak, and Germany has been slow to digitize government services. It also recalls an earlier cyberattack on Berlin’s Court of Appeal, which led to a prolonged return to paper-based work.

Comparisons with attacks on the British Library, Ireland’s health service, and the district of Anhalt-Bitterfeld illustrate how ransomware incidents can disrupt essential services and expose personal data. The video’s broader argument is that refusing a ransom may avoid rewarding criminals, but it cannot undo the harm once data has been stolen and released.

The subtitles use several inconsistent names for the ransomware group, so this summary refers to it simply as “the attackers.”

Presenter: DC