🔍 Read the full analysis: Attack Detection On 5% Of Devices: Berlin’s Rhysida Case And AI on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate departments were hit by a Rhysida ransomware attack in August 2026, and the group later published about 1.4 million files after the city refused its ransom demand. An rbb24 investigation found that the detection system in one affected department covered only 5% of its devices, excluding the identified entry PC and servers used to transfer data. The department cited financial reasons for the limited licensing; whether earlier budget cuts caused that gap has not been established.
Berlin’s cyberattack detection system covered just 5% of devices in the Senate Department for Urban Development, Building and Housing when Rhysida stole files from two state departments in August 2026, according to an rbb24 investigation. The department told the broadcaster that full coverage was not possible “for financial reasons”; the identified entry computer and the servers from which data was transferred were not covered.
The attack affected the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate says the main data outflow occurred from August 7 to 12, and the administration detected the attack on August 14. The Senate made the incident public three days later. Both departments were disconnected from the state network as a precaution, temporarily relying on telephone work and limiting some citizen services, rbb24 reported.
Rhysida demanded 30 bitcoin, which Berlin officials described as worth about two million euros at the time. The city refused to pay, and on September 4 the group published stolen files. Reports put the total at about 1.4 million files, although Chief Digital Officer Florian Hauer gave a lower figure of roughly 1.3 million after a second batch. The files reportedly included personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate said the material was predominantly unstructured data from employees’ shared and personal directories.
In its October 21 report, rbb24 said it found a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The Senate has said it expects information about citizens and companies to be among the stolen material. Hauer told the Interior Committee that the files carried, at most, the lowest of four classification levels.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection Coverage
The finding highlights a gap between having attack-detection software and having it in place where attackers operate. In this incident, the devices identified as the entry point and the servers used to move data were outside the licensed 5% coverage. That does not establish that broader coverage would certainly have stopped the attack or prevented the leak, but it means this system was not monitoring those devices.
For residents and employees, the publication of personal documents creates a risk of targeted impersonation or scam messages. Leaked details can make fraudulent communications appear credible. People whose information may be involved should treat unexpected messages claiming to come from authorities with caution, verify them through official contact channels, and report suspected misuse to police. The case also puts public attention on whether government agencies have the resources and monitoring needed to protect sensitive records.
Products Worth Considering
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Apple Watch Ultra 4 GPS + Cellular 49mm Smartwatch
Bose SoundLink Plus Portable Bluetooth Speaker, Black
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
Berlin’s Senate says the network was not attacked again after August 13, and the administration identified the incident the following day. A Tagesspiegel report said the departments were informed of the breach by the state IT service provider ITDZ. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. After the city declined to pay, Rhysida posted the files on September 4.
The detection gap sits against a longer record of concerns about funding, but a direct link has not been established. Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org in November 2024. The urban development department’s statement to rbb attributes the limited device licenses to financial reasons. Available reporting does not show that the earlier budget cuts specifically caused the 5% coverage. An internal 2023 information-security report, seen by rbb, had already proposed expanding systems to detect and defend against cyberattacks.
What the Coverage Gap Cannot Prove
Public reporting does not establish whether full device coverage would have detected the intrusion in time, prevented the data transfer or changed the outcome. It also does not explain why only 5% of devices were licensed, beyond the department’s statement that broader coverage was not possible for financial reasons. The relationship between the 2025 budget reductions and the licensing decision remains unconfirmed.
The exact total and full contents of the stolen data are also not settled in the accounts cited: officials have referred to roughly 1.3 million files, while several reports give about 1.4 million. The Senate expects data belonging to citizens and companies to be affected, but public information does not identify everyone whose details were exposed or establish that all published files have been reviewed.
Exposure Review and Security Changes
The next public developments to watch are further findings about whose data appeared in the leak, any official notification or support for affected people, and whether Berlin changes monitoring coverage across its departments. The available source material does not give a timetable for a full review or for extending the detection system to additional devices.
People who believe their information may have been exposed should follow notices from the relevant Berlin authority, verify unexpected requests through official channels, change reused passwords, enable two-factor authentication where available, monitor bank activity and report suspected identity misuse to police. These steps can reduce some risks, but they cannot remove personal information already published online.
Key Questions
What happened in the Berlin Rhysida case?
Rhysida stole data from two Berlin Senate departments in August 2026. After Berlin refused a demand for 30 bitcoin, the group published the files on September 4. Reports put the total at about 1.4 million files.
What did the rbb24 investigation find about detection?
It reported that the detection system in the urban development department had licenses for 5% of devices. The department said full coverage was not possible for financial reasons; the identified entry PC and data-transfer servers were not covered.
Does the reporting show budget cuts caused the limited coverage?
No. Berlin’s 2025 budget included cuts to intrusion detection and the IT service center, but the available reporting does not establish that those cuts caused the department’s 5% licensing level.
What kinds of information were in the leaked files?
Reports describe personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate said the material was largely unstructured data from employee directories and expects that citizen and company information may also be affected.
What should people do if they may be affected?
Follow communications from the relevant authority, verify unexpected messages through official channels, change reused passwords, use two-factor authentication where available, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
