Berlin refused to pay, and the files appeared anyway

The advice to refuse a ransom is sound and incomplete. It answers the question of whether to fund an attacker. It does not answer what happens to the data, because by the time the demand arrives the data has usually already gone.

Berlin declined to pay Rhysida a two-million-euro demand. The group published the stolen files on the dark web, a dump that Deutsche Welle put at 1,439,893 documents, with other reports describing roughly 5.7 terabytes.

Two city departments were affected. The material ranges from employee records and official correspondence to what have been described as potentially sensitive emergency-planning documents, which is the category that does not age out of relevance.

A stolen personnel file is a privacy failure with a defined set of victims. Emergency-planning material is an operational document about how a city responds when something goes wrong, and its value to an adversary does not decrease when the incident is closed.

The timeline is the part other organisations should read closely. The BBC reported that data was accessed between August 7 and August 12, and that two departmental networks were shut down on August 14.

Five days of access, then two more before containment. That is not an unusually slow response by public-sector standards, and it was still long enough for the attacker to complete the exfiltration on which every subsequent decision depended.

Berlin has established a central crisis response and says affected people will be notified under German and European data protection rules. Notification at this scale is itself a months-long operation, conducted in public, with its own costs.

The strategic lesson is uncomfortable for anyone who has written a policy of never paying. That policy governs one decision. It has no effect on the exposure created before the demand, and an organisation that treats refusal as its plan has confused a principle with a control.

The controls that would have mattered sit earlier. Detecting bulk data movement while it is happening, limiting what a compromised account can read, and knowing which repositories hold the material whose publication would be worst.

That last item is the one most organisations cannot answer quickly. Knowing where the sensitive material lives is unglamorous inventory work, and it is what determines whether a leak is embarrassing or operationally serious.

Berlin made the defensible choice and is living with the consequence, which is the honest version of this story. Refusing is right. It is not a mitigation, and treating it as one is how an organisation ends up with a policy instead of a plan.