🔍 Read the full analysis: Berlin’s Administration And Rhysida: Counting The Cost Of Detection on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate Department for Urban Development, Building and Housing told rbb24 that its cyberattack detection system covered licenses for only 5% of its devices; the computer identified as the attackers’ entry point and the servers involved in the data theft were outside that coverage. Rhysida published about 1.4 million files after Berlin refused a 30-bitcoin ransom demand, but it has not been established that the licensing shortfall caused the breach or that earlier detection would have stopped the theft.
Berlin’s cyberattack detection system covered licenses for just 5% of devices in the Senate Department for Urban Development, Building and Housing when the Rhysida ransomware group stole data from that department and the Senate Department for Mobility, Transport, Climate Protection and Environment in August 2026, according to an rbb24 investigation. The computer identified as the entry point and the servers from which data was taken were not covered, the urban development department told the broadcaster; the scale of coverage raises questions about how Berlin’s security spending matched its exposure, though the available reporting does not establish that the gap caused the attack.
Berlin detected the intrusion on August 14, after most of the data theft had taken place. The Senate says the main outflow occurred between August 7 and 12, and that the state network was not attacked again after August 13. The two departments were disconnected from the network as a precaution, disrupting some services, rbb24 reported. Berlin made the incident public three days after it was detected.
Rhysida demanded 30 bitcoin, then worth about €2 million, according to the Senate Chancellery. Berlin refused to pay. On September 4, after the deadline passed, the group published stolen files online. Reports put the total at about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer gave a lower figure of roughly 1.3 million after a second batch, according to the source material.
The leaked material includes personnel records, scanned identity documents, payslips, contracts and building-project information, according to rbb24 and Tagesspiegel reporting. The Senate described the material as largely unstructured data from employees’ shared and personal folders, rather than specialist applications. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature in the leak. Her department confirmed she was affected. The Senate expects citizen and company data may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The reported coverage gap matters because detection tools can only alert staff to activity on systems they monitor. In this incident, the department told rbb24 that its licenses covered one device in 20, and neither the identified entry computer nor the servers involved in the data transfer were within that coverage. That leaves a clear question about what the system could detect in practice, without proving what would have happened under broader coverage.
For people whose records were exposed, the publication of identity and employment information creates a risk of targeted impersonation or scam messages. The reporting also describes sensitive material, including a digital signature and personal records. The Senate has said the data could include information about citizens and companies, but the affected population and the full contents of the leak are not yet known.
The case also puts public-sector cybersecurity budgets under scrutiny. A detection system’s purchase or deployment does not by itself show that the systems most likely to be attacked are covered. Berlin’s reported decision to limit licenses for financial reasons makes the allocation of protection relevant to residents who depend on government services and whose data is held by public agencies.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
The timeline reported by the Senate and local media runs from the data theft in early August to public reporting about the leaked files in October. Berlin detected the attack on August 14 and isolated the two affected departments. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed. After Berlin declined the ransom demand, Rhysida posted the files on September 4.
The five-percent figure comes from the urban development department’s response to rbb24 about its detection system, introduced in 2026. The department said extending coverage to all devices was not possible “for financial reasons,” translated from its German statement. The broadcaster also reported that the entry computer and the servers from which data left were not covered by licenses.
There is a budget backdrop, but not a demonstrated causal link. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available sources do not establish whether those cuts caused the five-percent coverage or determined the security system’s licensing decisions. An internal information security report from 2023, seen by rbb, had already proposed expanding systems to detect and defend against cyberattacks earlier.
What the Coverage Gap Cannot Prove
The reporting establishes that licenses covered 5% of devices in the urban development department and that the identified entry computer and data-transfer servers were outside that coverage. It does not establish that the shortfall caused the breach, whether wider coverage would have detected the intrusion in time, or whether an alert would have prevented the files from being copied.
The exact number of affected files is also reported differently: most accounts cite about 1.4 million, while Hauer reportedly referred to roughly 1.3 million after a second batch. The Senate says citizen and company information may be affected, but the full number of people and organizations involved, and the complete contents of the published data, remain unclear. The relationship between the earlier budget reductions and the department’s licensing decision has not been established.
What Berlin Must Clarify
Berlin’s agencies will need to continue identifying whose records were exposed, what specific information appeared in the leak and what steps affected people should take. The source material does not give a date for a final investigation report or say whether the city plans to expand detection coverage. Further public information on system coverage, incident findings and remediation would help clarify how the attack progressed and what protections have changed.
People who may be affected should treat unexpected messages claiming to come from government offices with caution, verify them through known official channels, change passwords where appropriate and enable two-factor authentication. The source material also advises monitoring bank statements and reporting suspected misuse to police. These steps may reduce exposure to follow-on fraud, but they cannot establish whether a particular individual’s data was included in the leak.
Key Questions
What happened in the Berlin cyberattack?
Rhysida stole files from two Berlin Senate departments in August 2026. After Berlin refused a 30-bitcoin ransom demand, the group published the files on September 4.
What does the 5% figure mean?
The urban development department told rbb24 that licenses for its detection system covered 5% of its devices. The computer identified as the entry point and the servers involved in the data transfer were not covered.
What information was published?
Reports describe personnel files, scanned ID cards, payslips, contracts and project information among about 1.4 million files. The full contents and the number of people affected remain unclear.
Has Berlin confirmed that limited coverage caused the attack?
No. The reported coverage gap and the systems outside it are documented, but available reporting does not establish that the gap caused the breach or that broader coverage would have stopped the theft.
What should people do if they may be affected?
Be cautious with unexpected messages claiming to come from authorities, verify them using known official contact details, change passwords where appropriate, enable two-factor authentication and monitor bank statements. Report suspected misuse to police.
Source: ThorstenMeyerAI.com
