Refusal has a documented outcome with this group. Rhysida took around 500,000 files from the British Museum in 2023 and published them on the dark web after the museum declined to pay, including personal data on visitors, subscribers and staff [15]. The same mechanism is now pointed at Berlin, with one detail worth reading closely: the auction starting price on Rhysida's listing is 30 bitcoin, the identical figure demanded from the city, according to Der Spiegel [6]. Wegner never confirmed a sum himself, and the 30-bitcoin number with its rough two-million-euro valuation is Der Spiegel's reporting [3]. A refusal does not make the data go away; it simply moves the same price tag from the city to whoever bids.
Scope remains the city's open question. Officials have confirmed further leaks inside Berlin's transport and environment department [9] and say personal or other non-public data cannot be ruled out [10]. Rhysida's listing is far more specific than that, claiming contracts, non-disclosure agreements, personnel files, passwords and thousands of personal contact details [12]. State police, prosecutors and federal security services are all on the investigation [13], and none of them has publicly named the group the city is dealing with [11].
The containment record holds the wider lesson. It is narrower than it looks. Berlin isolated two department networks on 14 August and lost citizen-facing services for days [8]. The first known leak began 7 August, which puts seven days between earliest exfiltration and shutdown [18]. That seven-day gap governs how much data leaves a network. One city choosing isolation over availability, in one incident, is a record that covers Berlin alone.
Rhysida has claimed hundreds of attacks since it emerged in 2023, against government institutions and businesses of varying sizes in numerous countries [14]. The countdown and the auction are its routine pressure instrument, applied well beyond any single German capital. On that pattern, the order of events to expect is publication ahead of the completion of Berlin's own forensics [5], which means residents learn what was taken from a criminal listing rather than from the city that held it [10].
