On 4 September 2026 the dataset Rhysida had stolen from Berlin's state administration was published on the dark web. The ransomware group's ultimatum had expired that afternoon, and the Senate had refused to pay. Infosecurity Magazine reports a demand of 30 bitcoin, roughly €2 million, and a dataset of around 1.4 million files. Help Net Security, citing Rhysida's own listing, puts the volume at 5.79 TB across 1.44 million files. These are the attacker's figures. The state has said the content and scope are still being examined.
The leak is an argument for coordinated public-sector extortion policy. It does not show that Germany needs a statutory ban on paying.
What was refused, and what was exposed
According to Help Net Security, the intrusion is believed to have happened between 7 and 12 August, and affected departments were disconnected on 14 August. Governing Mayor Kai Wegner said the state would not meet the attackers' demands. Berlin's chief digital officer, Florian Hauer, said it "will not give in to blackmail" (as quoted by Infosecurity Magazine).
The stolen material is sensitive. Infosecurity Magazine, citing Euronews, reports a folder of emergency planning for terrorist attacks and disasters titled "AG CBRN-Rahmenplanung". Rhysida also claims personnel files, payroll data and home addresses. The listing, as relayed by Help Net Security, claims data on 12,076 individuals, 27,299 HR files, 2,738 health-related files and files containing plaintext credentials. The state says it "cannot be ruled out" that personal or other non-public data is affected, and the Senate Chancellery says affected people will be notified "on a risk-based basis."
Neither outlet reports a codified German no-pay rule. Berlin's refusal appears to have been a political decision made case by case. That matters for the policy question.
The strongest case for a no-pay rule
The case for a ban deserves a fair hearing. Ransom payments fund the next attack, and a government that pays advertises that it is a profitable target. A binding rule would remove the temptation to pay in the middle of a crisis. It would also remove the attacker's incentive to target public bodies at all, because attackers would know in advance that there is nothing to collect. Here the logic seems to have worked as intended: Berlin held its position under a public deadline.
Why a statutory ban is the wrong instrument
The weakness is that a ban only works if refusing to pay is survivable. Berlin's refusal cost it the data. Encrypted systems at a hospital, a utility or a municipal authority can cost lives or livelihoods, and a hard ban would push those decisions into secrecy, with payments made through intermediaries and never reported. Reporting is the foundation of any evidence-based response, so a rule that discourages it would make things worse.
The BSI states that extortion of companies and public bodies through ransomware is "the fastest growing area of cybercrime". It notes that municipalities and hospitals have been victims and that public bodies can operate only in a limited way for extended periods. A prohibition does nothing about those operational harms.
The trend also points to a softer lever. Börsen-Zeitung, reporting on the BSI's 2024 situation report, noted that the share of ransomware victims willing to pay fell from 56% in early 2021 to 36%. Victims are already paying less, without a legal mandate. Better backups, segmentation and rehearsed recovery drive that trend, and funding them does more than criminalising the last step of a failed defence.
The Berlin case also shows a limit of no-pay policy. Refusal does not protect the data. Once the attackers hold it, publication is their fallback. Even a flawless no-pay policy therefore leaves the harm of the leak in place, and that harm falls mostly on civil servants and residents whose details are now public. The most valuable measures come before the incident: data minimisation, segmentation, and keeping sensitive planning documents off general-purpose file shares.
What Germany should do instead
- Publish a standard playbook for public bodies. The default should be not to pay, with a documented escalation route for life-safety exceptions. A legal ban on paying is the wrong tool, but a clear default prevents panicked, inconsistent decisions.
- Coordinate across the Länder. Sixteen state administrations negotiating separately with the same criminal groups is a weakness. Shared incident response, shared threat intelligence through the BSI, and common notification templates for affected individuals would help.
- Fund resilience, not only deterrence. Tested offline backups and network segmentation are what make a refusal to pay sustainable.
- Keep reporting safe. Mandatory, confidential reporting of incidents and payments gives policymakers the data they lack. Punishing victims for what they report would dry that data up.
- Notify affected people quickly. The "risk-based" notification approach should come with a clear timetable, so civil servants and residents learn promptly what was exposed.
The bottom line
Berlin was right not to reward Rhysida, and its refusal is consistent with the declining willingness to pay that the BSI has documented. But the leak shows that the refusal came after the damage was done. The BSI's 2025 situation report describes the IT-security situation as remaining "at a tense level". The policy response should be a coordinated, funded and well-rehearsed defence of public bodies, with a clear non-payment default and transparent reporting. A new criminal prohibition would not deliver that.