Berlin breach shows the cost of refusing a ransom

Berlin’s state government has launched a major review after ransomware attackers published data stolen from two government departments.

The Rhysida group had offered 5.79 terabytes of data for auction with a starting price of 30 bitcoin. Berlin refused to pay, and the information was subsequently released.

A central crisis unit was established to coordinate the review, verification and assessment of the material. It will also support efforts to identify and notify affected citizens and businesses under German and European data-protection rules.

Berlin later said that its investigation had found no published material carrying higher national-security classifications. However, officials were still examining more than 1.2 million files, demonstrating the scale of work required even when the most sensitive systems appear unaffected.

The review is not simply a technical exercise. Each file may need to be assessed for personal information, contractual details, operational sensitivity and its possible impact on third parties. The organisation must then determine who requires notification and what protective action they should take.

Publication can also create continuing risks. Attackers may use exposed contact details and internal information to make phishing messages more convincing. Documents can be presented without context, altered or combined with false claims, forcing communications teams to respond while the underlying material is still being examined.

Berlin has warned against circulating unverified claims and acknowledged that further security reviews are likely to reveal structural weaknesses requiring additional investment.

Refusing to pay avoids funding criminals and provides no guarantee that data will be deleted. But organisations must prepare for what follows: months of document review, legal assessment, notification, monitoring and reputation management. Restoring systems may end the immediate disruption; managing published data can take much longer.