A few weeks ago, this was about the cyberattack on two Berlin Senate administrations – and how an IT incident became administrative reality overnight.
Now there is a new twist: the ransomware group "Rhysida" is demanding 30 Bitcoin from Berlin. If the city does not pay, the perpetrators threaten to publish confidential data. Governing Mayor Kai Wegner has made it clear: Berlin will not pay.
This is exactly the decision many organisations face in an emergency – and one that should be thought through beforehand, not only while it is happening.
A few thoughts on this, independent of the individual case:
Paying a ransom guarantees nothing. Neither that the data will actually be deleted, nor that it will not surface at some point anyway. At the same time, every payment funds the next victim.
Not paying, however, requires something many organisations underestimate in advance: a plan B that holds even when data is actually published. Communication, legal assessment, informing those affected – none of this can be improvised in 48 hours.
That is precisely the core of what NIS2 means by "business continuity management": not just having backups, but knowing in advance how to respond to the worst case – before it occurs.
Research as of: August 30, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
