🔍 Read the full analysis: Did AI And Device Coverage Shape Rhysida’s Attack On Berlin? on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster’s investigation found that Berlin’s cyberattack detection system covered licenses for only 5% of devices in the urban development department. Rhysida stole and later published about 1.4 million files, but the available reporting does not establish that the limited coverage caused the breach.
Berlin’s detection system covered licenses for only 5% of devices in its Senate Department for Urban Development, Building and Housing when the Rhysida ransomware group stole government data in August, according to an rbb24 investigation published October 21. The department told the broadcaster that expanding coverage was not possible “for financial reasons”; reporting says the computer identified as the attackers’ entry point and the servers from which data was taken were outside the covered group.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. The Berlin Senate says the main data outflow took place between August 7 and 12, 2026; the attack was detected on August 14. The state announced the incident three days later. The two departments were disconnected from the state network as a precaution, and some public services were limited, rbb24 reported.
Berlin refused Rhysida’s demand for 30 bitcoin, described by officials as about €2 million. The group published the stolen material on September 4 after the payment deadline passed. News reports put the leak at about 1.4 million files, while Berlin’s Chief Digital Officer Florian Hauer has also described the total as roughly 1.3 million after a second batch.
Reported contents include personnel records, scanned identity documents, payslips, contracts and building plans. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature; her department confirmed she was affected. The Senate has described the data as largely unstructured files from employees’ shared and personal directories, and said citizens’ and companies’ information may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The investigation focuses attention on a basic operational question: which devices a security system actually monitors. According to rbb24, neither the computer identified as the entry point nor the servers involved in the data transfer were covered by the department’s licenses. That does not prove broader coverage would have stopped the attack, but it means this system was not monitoring the specific devices implicated in the breach.
The consequences extend beyond the two departments. The published files reportedly contain personal and employment information, as well as material related to public projects and infrastructure. People whose details were exposed may face a higher risk of convincing impersonation or fraud attempts. The incident also raises questions about how agencies fund detection, logging and other safeguards, and whether limited resources leave important parts of a government network outside routine monitoring.
Berlin’s refusal to pay meant Rhysida published the stolen files, according to the reporting. The available source does not establish that paying would have prevented publication or protected the data. The public impact is already clear: information was exposed, government services were disrupted for a period, and affected people may need to watch for misuse.
Products Worth Considering
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
Jackery Explorer 2000 v2 Portable Power Station, 2042Wh
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
Berlin detected the incident on August 14, after the main data transfer had taken place, according to the Senate’s incident information. The state network was not attacked again after August 13, the Senate said. Officials made the breach public on August 17. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed; the Senate Chancellery said the demand was 30 bitcoin.
On September 4, after Berlin declined to pay, Rhysida posted the files online. The Senate has said the stolen material was predominantly unstructured data from staff directories, rather than information taken from specialist applications. Reporting by rbb24 and Tagesspiegel described a range of sensitive records, including identity documents and personnel information. The Senate said the material carried no higher than the lowest of four classification levels, as Hauer told the Interior Committee.
The funding debate predates the attack. In 2024, the two departments told rbb that IT security funding had been available only partly to the extent required. Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. No source cited here establishes that those budget changes caused the five-percent coverage.
What the Coverage Figures Cannot Prove
The investigation reports a 5% license coverage figure for one department; the source material does not provide a comparable figure for the mobility department or a full inventory of devices across either agency. It also does not identify the detection product or explain how its licenses were allocated and configured.
Most importantly, it remains unproven that limited coverage caused the breach, or that monitoring the entry computer and servers would have prevented data theft. The reporting links the uncovered devices to the attack path, but does not provide a technical incident analysis establishing what alerts would have fired under broader coverage. The relationship between the 2025 budget reductions and the department’s licensing decision is also not established.
The full scope of exposed personal and government data remains uncertain. The Senate expects citizen and company information to be affected, while the public reporting has identified particular records in the leak. Reports also vary between about 1.3 million and 1.4 million files. Those totals do not, by themselves, show how many individuals were affected.
Further Review and Public Alerts
Berlin’s next steps include clarifying the scope of affected data and people, explaining how security monitoring is being extended, and providing any further findings from its investigation. The source material does not give a date for a final technical report or say whether every device is now covered.
People who may be affected should be alert to messages that use personal details or claim to come from government offices. The official advice cited in the source is to verify messages through trusted channels, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. These steps can reduce the risk of account or identity abuse, but they cannot establish whether a person’s information was included in the leak.
Further reporting and official notices may clarify the number of affected people, what data was exposed and what monitoring changes Berlin has made. Until then, the confirmed account is narrower: the attack was detected after the main data outflow, Rhysida published the stolen files, and one department reported that its detection licenses covered only a small share of devices.
Key Questions
What happened in the Rhysida attack on Berlin?
Two Berlin Senate departments were affected by a cyberattack. The Senate says most data left the network between August 7 and 12, 2026; the attack was detected on August 14. Rhysida later published stolen files after Berlin refused its ransom demand.
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for the detection system in the Senate Department for Urban Development, Building and Housing, according to the department’s statement to rbb. The source does not provide the same coverage figure for the other affected department.
Did limited detection coverage cause the data theft?
That has not been established. Reporting says the identified entry computer and the servers from which data flowed were not covered, but the source material does not provide a technical analysis proving that broader coverage would have prevented the breach.
What information was exposed?
Reports describe personnel files, identity-document scans, payslips, contracts and building-related information. The Senate expects that information belonging to citizens and companies may also be affected, but the full scope and number of people involved remain unclear.
What should people who may be affected do?
Follow official notices and be cautious with unexpected messages that refer to personal details. The advice cited by the source includes verifying messages, changing passwords, enabling two-factor authentication, monitoring bank statements and reporting suspected misuse to police.
Source: ThorstenMeyerAI.com
