Berlin Won’t Pay Extortion Group Claiming Data Theft

The Rhysida ransomware group successfully exfiltrated over 5TB of data from Berlin's city network over a five-day window, targeting a sensitive government department responsible for mobility, transport, and climate protection. The multi-day exfiltration window — August 7 to 12 — suggests that detection and alerting mechanisms failed to identify abnormal data movement in time to prevent a significant breach. Ransomware groups like Rhysida increasingly use double-extortion tactics, stealing data before encrypting systems to maximize leverage against victims. While Berlin's refusal to pay is commendable policy, the incident highlights that public institutions remain high-value targets and must invest proactively in detection, segmentation, and data protection controls rather than relying on post-incident negotiations.