🔍 Read the full analysis: 5% Device Detection And The Rhysida Attack On Berlin’s Administration on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A public broadcaster’s investigation reported that Berlin’s attack-detection system covered just 5% of devices in the Senate Department for Urban Development, Building and Housing. The Rhysida ransomware attack, detected in August 2026, led to the publication of about 1.4 million files after Berlin refused a ransom demand; officials have not established that budget cuts caused the limited coverage.
Berlin’s Rhysida ransomware attack exposed a gap in the city administration’s cyber defenses: an attack-detection system introduced in 2026 covered licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing, according to an rbb24 investigation published in October. The attackers stole data from that department and the Senate Department for Mobility, Transport, Climate Protection and Environment, then published about 1.4 million files after Berlin rejected a ransom demand.
The Senate says most of the data was taken between August 7 and 12, and the attack was detected on August 14. The affected departments were disconnected from Berlin’s state network as a precaution. The Senate made the incident public three days later. Officials said the network was not attacked again after August 13, according to the city’s incident information page.
The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin did not pay. On September 4, the group published stolen files after the ransom deadline passed. Authorities and news outlets have described the total as about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer earlier referred to roughly 1.3 million after a second batch.
Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity documents, payslips, job references, contracts and building-project information among the material. The Senate said the files were mainly unstructured data from employee shared and personal folders, rather than information taken from specialist applications, and said citizens and companies may also be affected. Rbb24 reported in October that the leak included a copy of Transport Senator Ute Bonde’s identity card and stored digital signature; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Detection Gap With Public Costs
The reported coverage figure matters because the system did not monitor the devices identified in the attack. The urban development department told rbb that neither the computer identified as the entry point nor the servers from which data left were covered by its licenses. Detection tools cannot alert administrators to activity on devices they do not monitor, although coverage alone does not establish how the attack would otherwise have unfolded.
The leak also creates risks beyond disruption to government operations. Personal documents and employment information can be used to make scams more convincing or expose people to identity misuse. Information about public projects and infrastructure may carry separate security implications. The Senate said the stolen files were at most at the lowest of its four classification levels, but that designation does not mean the personal material is harmless.
The incident raises a practical question for public agencies: whether security systems are funded and deployed across the devices and servers that hold sensitive information. It does not, by itself, prove that broader coverage would have prevented the theft or identify a single cause for the limited deployment.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Apple Watch Series 12 GPS 46mm
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
Berlin’s administration detected the incident on August 14 and isolated both affected departments from the state network. Rbb24 reported that some services for residents were limited and staff temporarily relied on phone-based work. The Senate said the main data outflow occurred over the preceding days, leaving little time to stop the bulk of the theft once the incident was identified.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. After the city declined to pay, Rhysida posted the files on September 4. The October rbb24 investigation then connected the scale of the leak with the limited device coverage in one department. The department said wider licensing was not possible “for financial reasons”, according to rbb’s translation.
There was earlier evidence of financial pressure on IT security. In 2024, the two departments told rbb that funding for required IT security measures was available only “partly to the required extent”, in the broadcaster’s translation. Berlin’s 2025 budget reduced a line for intrusion detection by €2 million and cut the IT service center’s budget from €32.2 million to €18.2 million, netzpolitik.org reported in November 2024. The available reporting does not establish that those cuts caused the five-percent coverage.
Coverage, Cause and Exposure Still Unclear
The reported 5% figure applies to licensed devices in the urban development department; the source material does not provide a comparable coverage figure for the mobility department or a full inventory of systems affected. It also does not explain precisely how the attackers entered, how they maintained access, or which security alerts were available to staff during the August intrusion.
It remains unproven that budget reductions caused the limited coverage. The timing of the cuts and the department’s stated financial constraint provide context, but reporting has not established a direct causal link. The exact number of files and the full population of people or organizations whose information was exposed also remain uncertain: officials and outlets have cited different totals, while the Senate expects data belonging to citizens and companies may be included.
There is no complete public account in the supplied reporting of what data has been accessed or misused since publication. The exposure of Bonde’s identity card and digital signature is one reported example, not a full accounting of the leak.
Incident Review and Public Guidance
The next major developments are likely to be a fuller accounting of affected data, any further updates from Berlin’s Senate and the results of reviews into how the intrusion went undetected. The source material does not give a date for a completed investigation, a decision on how widely detection licenses will be expanded, or a confirmed estimate of the attack’s full cost.
People who may have been affected should be alert to messages that use personal details while claiming to come from a government office. The advice cited in the source material is to verify official messages through trusted channels, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. Those steps can reduce some risks, but they do not confirm whether an individual’s information was among the published files.
Key Questions
What happened in the Berlin Rhysida attack?
Attackers stole data from two Berlin Senate departments in August 2026. Rhysida later published about 1.4 million files after Berlin refused a ransom demand of 30 bitcoin, then worth about €2 million.
What does the 5% device figure refer to?
According to an rbb24 investigation, licenses for the attack-detection system covered 5% of devices in the urban development department. The department said expansion to all devices was not possible for financial reasons.
What kinds of information were exposed?
News reports identified personnel records, identity-document scans, payslips, contracts and building-project information. The Senate said the stolen files were mainly unstructured data from employee folders and that citizen and company data may also be affected.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget included reductions affecting intrusion detection and the IT service center, but available reporting does not prove those cuts caused the department’s 5% device coverage.
What should potentially affected people do?
Be cautious with messages that appear to come from authorities, verify them through trusted channels, change passwords, turn on two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
