🔍 Read the full analysis: AI, Attack Detection, And The Cost Of Berlin’s Rhysida Breach on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole files from two Berlin government departments in August 2026 and published about 1.4 million files on September 4 after the city refused to pay a ransom. An rbb24 investigation found that the attack-detection system at the urban development department covered licenses for only 5% of devices, including neither the reported entry computer nor the servers used to transfer data. The city has not established that earlier budget cuts caused that limited coverage.
Berlin’s attack-detection system covered licenses for only 5% of devices in its Senate Department for Urban Development, Building and Housing when the Rhysida ransomware group stole data from that department and another state agency in August, according to an rbb24 investigation published October 21. The department told the broadcaster that expanding coverage to all devices was not possible “for financial reasons”; the computer identified as the entry point and the servers from which data was transferred were not covered.
The Berlin Senate says the main data outflow occurred between August 7 and 12. The attack was noticed on August 14, and the Senate made it public three days later. The affected agencies were the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin disconnected both from the state network as a precaution; rbb24 reported that some services were limited while staff worked by phone.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin did not pay. On September 4, the group published the files online. Estimates vary: the Senate’s chief digital officer, Florian Hauer, referred to roughly 1.3 million files after a second batch, while several reports put the total at about 1.4 million.
Reporting by rbb24 and Tagesspiegel described leaked personnel records, scanned identity documents, payslips, employment references and contracts, as well as information about construction projects and critical infrastructure. The Senate characterized the material as mostly unstructured files from employees’ shared and personal directories, rather than data from specialist applications. It said citizens’ and companies’ data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The reporting connects a specific security gap to a breach in which sensitive government files were copied over several days before officials detected the intrusion. The department’s statement confirms that only 5% of devices had licenses for the detection system; rbb24 reported that the apparent entry computer and data-transfer servers were outside that coverage. The available information does not show that broader coverage alone would have prevented the theft, but it does identify a limitation in the tools available to spot activity across the department’s systems.
For people whose records may be in the files, publication creates a continuing risk of impersonation or targeted scams. Leaked identity details and employment information can make fraudulent messages appear credible. The incident also matters beyond the two agencies because the Senate says records belonging to citizens and businesses may be included, while the file set reportedly contains information about public construction and infrastructure.
For public agencies and other organizations, the episode puts the operational consequences of partial detection coverage in view: a tool cannot alert on devices it does not cover. That is a practical lesson, not proof that a particular budget decision caused the breach. Berlin’s response, the scope of affected records and any later changes to monitoring will help show whether the identified gap is being addressed.
Products Worth Considering
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Dell P2725H 27-Inch Full HD Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The Senate’s timeline places the main theft between August 7 and 12, 2026, followed by detection on August 14. The state network was not attacked again after August 13, according to the Senate’s information page. A Tagesspiegel commentary reported that the departments were informed of the incident by the state IT service provider, ITDZ. The city later isolated the affected departments while investigating.
Rhysida’s demand and the subsequent publication turned a government cyber incident into a data-exposure case. After Berlin refused to pay, the group posted files on September 4. Rbb24’s October reporting highlighted the exposure of Bonde’s identity card and digital signature, bringing attention to the potential consequences for individuals as well as the departments. The Senate’s chief digital officer told an Interior Committee that the stolen files carried no higher than the lowest of four classification levels; that classification does not resolve the sensitivity of personal information contained in them.
The detection system was introduced in 2026, according to the department’s response to rbb. Separately, netzpolitik.org reported that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The source reporting does not establish that those cuts caused the system’s 5% licensing coverage, so the budget figures are relevant background rather than a demonstrated cause of the breach.
What the Investigation Has Not Established
The available reporting does not establish that the 2025 budget cuts caused the detection system to cover only 5% of devices. The connection between those budget figures and the department’s licensing decision remains unproven. Nor does the reported coverage gap by itself establish that full coverage would have detected or stopped the attackers.
The final number of exposed files and the complete set of affected people and organizations also remain uncertain. Reports cite about 1.3 million and about 1.4 million files, while the Senate says citizens’ and companies’ data may be involved. The Senate has said the files were mostly unstructured employee-directory data, but the full contents have not been publicly accounted for. It is also not clear from the source material what monitoring, staffing or security changes Berlin has made since the attack.
Follow-Up on Victims and Security
Berlin’s ongoing task is to determine which people and organizations are affected, notify them where appropriate, and investigate how the attackers entered and moved data through the network. Further public statements or committee discussions may clarify the number and types of records involved, the status of the investigation and whether the departments have expanded detection coverage.
People who may be affected should treat unexpected messages that cite personal or employment details with caution. The source material advises verifying any message claiming to come from an authority, changing passwords, enabling two-factor authentication, reviewing bank statements and reporting suspected misuse to police. Those steps do not establish that a particular account or record has been compromised; they are precautions while the scope of the leak remains under review.
Key Questions
What happened in the Berlin Rhysida breach?
Rhysida stole data from two Berlin Senate departments in August 2026. After the city refused a reported demand of 30 bitcoin, the group published files online on September 4.
How many files were published?
Reports put the total at about 1.4 million files. Berlin Chief Digital Officer Florian Hauer referred to roughly 1.3 million after a second batch, so published estimates differ.
What did the reporting find about attack detection?
Rbb24 reported that licenses for the system at the urban development department covered 5% of its devices. The reported entry computer and the servers used to transfer data were not covered.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget included reported cuts to intrusion-detection funding and the IT service center, but the available reporting does not demonstrate that those cuts caused the 5% coverage level.
What should people do if they may be affected?
Be cautious with messages using personal details, verify requests that claim to come from authorities, change passwords, enable two-factor authentication, review bank statements and report suspected misuse to police. The full set of affected people remains unclear.
Source: ThorstenMeyerAI.com
