🔍 Read the full analysis: Attack Detection On 5% Of Devices: How Rhysida Got Into Berlin’s Administration, And What The Savings Really Cost on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole about 1.4 million files from two Berlin state departments in August 2026, then published them after the city refused a ransom demand. An rbb investigation reported that one department’s attack-detection system covered licenses for only 5% of its devices; neither the identified entry computer nor the servers used to take data out were covered.
Rhysida stole about 1.4 million files from two Berlin state departments in August, and a public broadcaster’s investigation has found that a cyberattack-detection system at one department covered licenses for only 5% of its devices. The urban development department told rbb that neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered by the system.
Berlin said the main data outflow took place from August 7 to 12, 2026. The attack was detected on August 14, and the state made it public three days later. The affected departments—the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment—were disconnected from the state network as a precaution. Some services were limited while staff worked by phone, rbb24 reported.
Rhysida demanded 30 bitcoin, described by the Senate Chancellery as worth about €2 million. Berlin refused to pay. On September 4, after the deadline passed, the group published the stolen files. Berlin Chief Digital Officer Florian Hauer referred to roughly 1.3 million files after a second batch; several outlets, including rbb24 and Tagesspiegel, reported about 1.4 million files.
The material included personnel records, scanned identity cards, payslips, contracts and building-project information, according to reporting by rbb24 and Tagesspiegel. The Senate described the data as mostly unstructured files from employees’ shared and personal directories and said citizens’ and companies’ data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature in the leak; her department confirmed that she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Coverage Gap in Berlin’s Defenses
The reported 5% coverage matters because the system’s reach did not include the devices identified in the attack pathway: the entry computer and the servers used to transfer data. A detection product installed on only part of a network may leave important activity beyond its visibility. The available reporting does not establish that broader coverage would certainly have stopped this breach, but it identifies a specific limitation in the department’s defenses.
The stolen records also create risks beyond disruption to government operations. Identity documents, payroll information and other personal files can be used to make fraudulent messages more convincing or to support identity misuse. People whose information may have been exposed should be cautious with unexpected messages claiming to come from authorities, monitor accounts and report suspected misuse. The source material advises changing passwords and enabling two-factor authentication where available.
The incident also raises a public-budget question: whether Berlin’s investment in security matched the protection its departments needed. The department attributed the limited licenses to financial reasons. That is an explanation from the department, not proof that a particular budget decision caused the breach or that one additional purchase would have prevented it.
Products Worth Considering
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
Trezor Safe 7 Crypto Hardware Wallet
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
According to the Senate’s account, the main theft occurred between August 7 and 12, and the state network was not attacked again after August 13. Berlin detected the incident on August 14 and isolated the two departments. The Senate announced the breach on August 17. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed; the Senate Chancellery said the demand was 30 bitcoin.
After Berlin declined to pay, Rhysida posted the files on September 4. The leak’s contents became clearer through subsequent reporting. In an October investigation, rbb24 reported finding Bonde’s identity-card copy and stored digital signature, along with emails belonging to former transport senators Manja Schreiner and Bettina Jarasch. The Senate has said the files carried no higher than the lowest of its four classification levels, while also expecting that citizens’ and businesses’ information may be included.
There was already a broader funding debate. A November 2024 report by netzpolitik.org said Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million. The available source material does not establish that these cuts caused the five-percent coverage. The urban development department also told rbb that the necessary IT-security funds had been available only partly to the required extent in 2024.
“Extending the system to all devices was not possible for financial reasons.”
— Berlin’s urban development department, as reported by rbb; translated from German
What the Investigation Cannot Establish
The full number of people and organizations whose information was exposed remains unclear. The Senate expects that citizens’ and companies’ data may be affected, but the source material does not provide a complete count or a definitive inventory of the leaked records. Media reports give different totals: Hauer referred to roughly 1.3 million files after a second batch, while other outlets report about 1.4 million.
It is also not established whether expanded detection coverage would have identified or stopped the intrusion in time. The department said licenses covered 5% of its devices and that key systems were outside that coverage; the reporting does not document what alerts those systems could have generated if covered. Nor does the reported 2025 budget reduction establish that budget cuts caused the coverage gap. The full route used by the attackers, the complete extent of access and whether all affected individuals have been identified remain unresolved in the provided reporting.
Follow-Up on Exposure and Security
Berlin’s next task is to determine which people and organizations are represented in the published files and to notify those affected. The source material does not specify a completion date for that review. The city also faces questions about what changes it will make to detection coverage, logging and network safeguards following the attack; no full remediation plan or timetable is provided in the reporting.
People who may be affected should treat unexpected messages that use personal or employment details with caution, verify requests through official channels, change reused passwords, enable two-factor login where possible, monitor bank statements and report suspected identity misuse to police. Any further assessment should distinguish confirmed exposure from data that authorities say may have been included.
Key Questions
What happened in the Berlin cyberattack?
Rhysida stole files from Berlin’s urban development and mobility departments in August 2026. After the city refused a ransom demand, the group published the files on September 4.
What does the 5% figure refer to?
The urban development department told rbb that licenses for its attack-detection system covered 5% of its devices. The computer identified as the entry point and the servers used to take data out were not covered.
What information was in the leaked files?
Reporting described personnel records, scanned identity cards, payslips, contracts and building-project information. The Senate said the files were mostly unstructured material from staff directories and that citizens’ and companies’ information may also be affected.
Did Berlin pay Rhysida’s ransom?
No. The Senate Chancellery said the group demanded 30 bitcoin, worth about €2 million, and Berlin refused. Rhysida published the files after the deadline passed.
Did Berlin’s budget cuts cause the limited coverage?
The available reporting does not establish that. A 2024 report described planned reductions in Berlin’s 2025 security and IT budgets, but the connection between those cuts and the department’s 5% license coverage is not confirmed.
Source: ThorstenMeyerAI.com
