Roughly 1.44 million files weighing 5.8 terabytes, taken from Berlin's state administrative network, have been dumped online after the city-state's government turned down a ransom demand of 30 Bitcoin (BTC) — a sum worth about €2 million at the Bitcoin price when the attackers set it.

According to a report published by COINOTAG on October 30, 2026, the publication of the files followed Berlin's decision not to meet the attackers' demand. (COINOTAG)

Berlin is both Germany's capital and one of the country's 16 federal states. As a so-called city-state, it operates its own state government and state-level administration, and the data in question was taken from that administrative network.

Ransom demands denominated in Bitcoin are a common feature of cyber extortion. Bitcoin is a decentralized digital asset that can be transferred across borders without banks or payment processors, and its pseudonymous design has made it a frequently used means of payment for ransomware operators. Extortion groups commonly pair the theft of data with payment demands, threatening to publish the stolen material if their terms are refused — a tactic known in the cybersecurity field as double extortion, and a sequence matching the events described in the report.

That dynamic also shapes official guidance: because stolen copies may remain in circulation even after a ransom is paid, cybersecurity authorities in Germany and internationally generally advise organizations against paying, warning that payment does not guarantee the deletion of stolen data or prevent its further dissemination.

This content was first published on COINOTAG: https://en.coinotag.com/berlin-refuses-30-bitcoin-btc-ransom-5-8tb-files-leak