Berlin's press release tells police officers that support services exist for people who come in to report finding their own data in the dump [14]. That is a plan built around what people do when a leak is announced, which is turn up at a counter and ask a human being whether they are in it. Berlin's formal ask of those people is that they file a criminal complaint, online or at a station [15]. Someone has to sit at that counter, every day, for as long as the queue lasts.
Count the standing bodies. A special task force at the State Criminal Police Office, another inside the transport department, a joint one across the two departments that were hit [10], an ICT emergency task force meeting until further notice [12], and the housing department's crisis management team [11]: five bodies with recurring meetings, plus outside counsel and a contact point for staff [27]. Berlin says it sees no current evidence that the attackers still hold the state network, and forensic work continues on whether more was taken than anyone yet knows [13]. Those meetings run on the timetable of the notification work, not of the intrusion.
The only figure in the story with a currency attached belongs to the sellers. The auction opened at a minimum bid of 30 bitcoin, which Berlin puts at roughly 2 million euros [18]. Reuters gave that minimum as $77,622 [19]. Thirty times $77,622 is $2,328,660, which sits alongside Berlin's euro number, and thenextweb.com reads the dollar bracket as the price of one coin rather than the total [20][30]. Taken as a total instead, it understates the opening bid by a factor of thirty [31].
Berlin says Rhysida asserts it holds 5.7 terabytes, while Reuters and the BBC both print 5.79, and nobody outside the group selling the files has confirmed either [17]. The inventory of contracts, non-disclosure agreements, personnel files and passwords comes from the dark web listing Der Spiegel screenshotted in August [9]. Berlin's own account is narrower and duller: personal data on state employees, residents and businesses [8]. That follows from what the two hit departments actually hold [6], which for a city-state is bus operations and building permits, since German national defence belongs to the federal government and the Bundeswehr [7]. A central crisis unit is meant to verify the contents and tell the people affected [5], which means reconciling a seller's manifest against records the state does have.
Refusal has precedent and a known ending. Rhysida took around 500,000 files from the British Museum in 2023, the museum declined to pay, and the group published them [21]. Grafana Labs turned a ransom down in May, when the stolen code was already open source [23]. Rhysida has claimed hundreds of attacks since it emerged in 2023, with activity traced to Russia and eastern Europe [22]. State senator Iris Spranger says the Berlin attack did not reach election infrastructure [26], which is the one comfortable fact in a city that votes on 20 September [25].
The usable thing here is Berlin's list, read as a template. The test is whether you can write a different name against each box: who verifies contents against an inventory you cannot trust, who answers staff, who staffs the walk-in counter, who takes the legally sensitive call on a Sunday, who runs the ICT recovery. If one name lands in more than two boxes, what you have is a person rather than a structure, and that person takes holiday. The decision to refuse is made in an afternoon. The staffing it implies runs for months.
