🔍 Read the full analysis: Rhysida And Berlin: How Limited Attack Detection Shaped The Cost Of AI on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin officials said the Rhysida attack copied data from two Senate departments in August 2026, and the group published the files after the city refused its ransom demand. An rbb24 investigation reported that an attack-detection system covered only 5% of devices in one department, excluding the computer and servers involved; the precise financial impact of that coverage gap is not established.
Berlin’s attack-detection system covered only 5% of devices in its Senate Department for Urban Development, Building and Housing when the department was among two hit by the Rhysida ransomware group, according to an rbb24 investigation published October 21, 2026. The department told the broadcaster that expanding coverage was not possible “for financial reasons”; the computers identified as the entry point and the servers from which data was taken were not covered.
The attack affected the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate said the main data outflow took place between August 7 and 12. The administration detected the attack on August 14, disconnected both departments from the state network and made the incident public three days later. The Senate said there was no further attack on the state network after August 13.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then valued at about €2 million. Berlin did not pay. On September 4, the group published the stolen material. Reports put the leak at about 1.4 million files; officials have also cited a lower estimate of roughly 1.3 million after a second batch.
The files reportedly include personnel records, scanned identity documents, payslips, contracts and building-project information. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature among the leaked material. Her department confirmed that she was affected. The Senate has described the data as mainly unstructured files from employees’ shared and personal directories and said citizens’ and companies’ data may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert defenders to activity on devices they monitor. In this incident, the department told rbb24 that neither the computer identified as the entry point nor the servers from which data left were covered by the system. That account points to a concrete limitation in the monitoring setup, but the available reporting does not establish that broader coverage would have prevented the theft or changed its scale.
The breach has consequences beyond government operations. The published files reportedly contain sensitive personal and employment information, and the Senate expects residents’ and businesses’ data may be among the affected material. People whose details were exposed could face targeted scam messages or attempts to misuse their identities. Berlin’s refusal to pay also did not prevent the group from publishing the stolen files.
The case raises a practical public-sector question: how much protection does a security system provide when only a small share of devices is licensed? The department cited financial limits. A prior Berlin budget cut affected intrusion-detection funding, but a direct link between that reduction and the five-percent coverage is not established.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Sonos Era 100 SL Compact Microphone-Free Speaker – Black
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
Berlin’s Senate said the bulk of the data was taken over several days, before officials detected the incident on August 14. The two departments were removed from the state network as a precaution and, for a time, relied on telephone work; some public services were limited, rbb24 reported. A Tagesspiegel account said the departments were informed of the attack by the state’s IT service provider, ITDZ.
The ransom deadline passed without payment, and Rhysida published the files on September 4. In an October investigation, rbb24 reported finding Bonde’s ID and digital-signature copy, along with emails belonging to former transport senators. The department confirmed Bonde was affected. The urban development department’s account of its detection system—introduced in 2026 and licensed for 5% of devices—was also reported by rbb24.
There had been earlier warnings about resources for cybersecurity. In 2024, both departments told rbb that funding for IT security had been available only partly to the extent they considered necessary. Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. Those figures provide budget context, but the sources do not show that the cuts caused the limited coverage in this attack.
What the Coverage Gap Establishes
The department’s statement and rbb24’s reporting establish that the system covered 5% of devices and did not monitor the reported entry computer or data-egress servers. They do not establish whether broader coverage would have detected the intrusion in time, stopped the data transfer or reduced the number of files taken. The precise number of files also varies across accounts: most reports cite about 1.4 million, while Chief Digital Officer Florian Hauer has referred to roughly 1.3 million after a second batch.
The full set of affected people and organizations is not yet clear. The Senate expects citizens’ and companies’ data to be included, while reporting has identified especially sensitive records in the leak. The available source material does not give a complete accounting of those affected or establish a direct causal connection between Berlin’s budget reductions and the five-percent licensing level.
Notifications and Security Follow-Up
Berlin’s authorities will need to clarify who was affected, what categories of data were exposed and how they are notifying people and organizations. Further public reporting may establish whether the city expanded monitoring after the breach, and whether it changed access controls, logging or protection of shared servers. The source material does not specify a timeline for those steps or identify a new coverage target.
People who may be affected should treat unexpected messages that cite personal details with caution. The official advice cited in the source is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. Those steps reduce risks but do not determine whether a particular person’s information was included.
Key Questions
What happened in Berlin?
The Rhysida ransomware group stole data from two Berlin Senate departments in August 2026 and published files on September 4 after the city refused its ransom demand. The Senate said the main data outflow occurred from August 7 to 12.
What did rbb24 report about attack detection?
It reported that a detection system introduced in 2026 covered only 5% of devices in the urban development department. The department said full coverage was not possible for financial reasons; the reported entry computer and data-egress servers were outside the covered group.
What information was exposed?
Reports describe personnel files, scanned IDs, payslips, contracts and building-project information among about 1.4 million files. The Senate expects citizens’ and companies’ data may also be affected, but a complete list of affected people has not been provided in the source material.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, about €2 million at the time. Berlin refused, and the group later published the files.
Did budget cuts cause the limited monitoring?
That has not been established. Berlin’s 2025 budget cut intrusion-detection funding by €2 million, but the available reporting does not show that this reduction caused the system to cover only 5% of devices.
Source: ThorstenMeyerAI.com
