🔍 Read the full analysis: Attack Detection On 5% Of Devices: How Rhysida Got Into Berlin’s Administration, And What The Savings Really Cost on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole data from two Berlin government departments in August 2026 and published about 1.4 million files after the city refused to pay a 30-bitcoin ransom. An rbb24 investigation found the attack-detection system in the urban development department covered licenses for only 5% of devices; the entry computer and data-transfer servers were outside that coverage.
Rhysida stole data from two Berlin government departments in August and later published about 1.4 million files; an rbb24 investigation has found the attack-detection system in the urban development department had licenses for only 5% of its devices. The department told the broadcaster that expanding coverage was not possible “for financial reasons,” while the computer identified as the attackers’ entry point and the servers that transferred data were not covered.
Berlin’s Senate says most of the data left the network between August 7 and 12, 2026. The attack was detected on August 14, and the state made it public three days later. The two affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. They were disconnected from the state network as a precaution, and some services were limited, rbb24 reported.
After Berlin refused Rhysida’s demand for 30 bitcoin, then valued at about €2 million, the group published the files on September 4. The Senate has described the material as mainly unstructured data from employees’ shared and personal directories. Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate expects data belonging to citizens and companies may also be affected.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The broadcaster also found emails belonging to her predecessors. Berlin’s Chief Digital Officer Florian Hauer put the total at roughly 1.3 million files after a second batch; other reporting, including rbb24’s, has described the total as about 1.4 million.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Detection Coverage Left Key Systems Exposed
The reported coverage gap matters because the affected detection software did not monitor the computer identified as the entry point or the servers from which data was taken. In practical terms, having a security product installed on some devices did not mean the systems involved in this incident were being monitored by it. The source material does not establish that wider coverage would necessarily have stopped the breach, but it shows a gap between the department’s stated detection capability and the devices implicated in the attack.
The stolen material included personal records and identity documents, creating risks beyond disruption to government operations. People whose information appeared in the files may face targeted scams or attempts to misuse their personal details. The publication of building and infrastructure-related information also raises concerns, although the Senate said the files were at most at the lowest of four classification levels. That classification does not establish that every exposed document was harmless.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From August Exfiltration to October Findings
The Senate says the state network was not attacked again after August 13. The incident was detected the next day, and the two departments were separated from the network while officials responded. The Senate later confirmed the blackmail demand, and Berlin declined to pay. Rhysida published the stolen material after the ransom deadline, making the breach a continuing privacy concern even after the network activity had stopped.
The 5% figure comes from rbb24’s reporting and a statement by the urban development department; it applies to that department’s device licenses, not necessarily every Berlin government agency. The source material also describes a wider funding backdrop: Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center’s budget line from €32.2 million to €18.2 million. It has not been established that those budget reductions caused the limited coverage reported in the department.
Berlin’s information-security guideline has required authorities since 2017 to provide adequate staff and resources for protection, according to the source material. An internal 2023 security report reportedly called for expanding systems to detect and defend against attacks earlier. These details indicate that security coverage had been a stated concern before the 2026 incident, but they do not by themselves establish why the specific license decision was made.
Open Questions on Exposure and Funding
The full scope of the stolen data remains unsettled. The reported totals differ, with Hauer citing roughly 1.3 million files after a second batch and other coverage reporting about 1.4 million. The Senate expects citizens’ and companies’ information may be present, but the source material does not give a complete count of affected people or organizations, or a definitive inventory of every exposed document.
It is also unclear how the attackers entered the network beyond the reported identification of an entry computer, what precise path they used to reach the servers, and whether other security controls detected any activity. The available reporting does not establish that the 2025 budget reductions caused the 5% licensing level or that broader detection coverage alone would have prevented the theft. The consequences of exposed documents, including any misuse, have not been fully reported.
Victim Guidance and Berlin’s Security Review
People who may be affected should be alert to messages that use leaked personal details or claim to come from a government office. The advice described in the source material is to verify official-looking messages independently, change passwords where appropriate, enable two-factor authentication, monitor bank statements and report suspected misuse to police. Recipients should avoid treating a message as genuine simply because it contains accurate personal information.
Berlin still needs to clarify the scale of exposure and what security changes will follow, including whether detection coverage will be expanded and how the devices involved in the breach will be monitored. The cited reporting does not provide a confirmed completion date for that work or a final account of the attack’s full impact. Further updates from the Senate and affected departments are needed to establish what data was exposed and what protections are now in place.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says data was taken from two Senate departments, mainly between August 7 and 12, 2026. Rhysida later published the files after Berlin refused its ransom demand.
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for an attack-detection system in the urban development department, according to the department’s statement to rbb24. The figure is not stated to apply to all Berlin agencies.
How many files were published?
Reports commonly describe about 1.4 million files. Chief Digital Officer Florian Hauer cited roughly 1.3 million after a second batch; the figures differ across accounts.
What information was exposed?
Reporting identified personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate says the data was mainly from employee directories and expects some citizen and company data may also be involved.
Did budget cuts cause the limited detection coverage?
That has not been established. Berlin’s budget included cuts to intrusion-detection and IT-service funding, but the available reporting does not show that those cuts directly caused the department’s 5% coverage.
Source: ThorstenMeyerAI.com
