🔍 Read the full analysis: Did Berlin’s Security Savings Leave Devices Exposed To Rhysida? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin officials say Rhysida stole data from two Senate departments in August 2026 and published about 1.4 million files after the city refused to pay a ransom. An rbb24 report found the detection system in one department covered only 5% of its devices; the department said full coverage was not possible for financial reasons. The available reporting does not establish that earlier budget cuts caused the limited coverage.
Berlin’s attack-detection software covered licenses for only 5% of devices in its Senate Department for Urban Development, Building and Housing, according to the department’s statement to public broadcaster rbb24, and the systems attackers used were outside that coverage. The finding adds a specific security gap to the confirmed August theft of data from two Berlin Senate departments, which the Rhysida ransomware group later published after the city declined to pay a ransom.
The attack affected the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate says most of the data left the network between August 7 and 12, 2026; officials noticed the incident on August 14. The two departments were disconnected from the state network as a precaution, disrupting some services, rbb24 reported. Berlin made the attack public three days after it was detected.
The Senate Chancellery said Rhysida demanded 30 bitcoin, valued at about €2 million, and Berlin refused to pay. On September 4, the group published files online. Reports put the total at about 1.4 million files, although Chief Digital Officer Florian Hauer has described the total as roughly 1.3 million after a second batch. The Senate says the stolen material was mainly unstructured data from employees’ shared and personal directories, rather than specialist applications.
Reporting by rbb24 and Tagesspiegel describes personnel records, scanned identity cards, payslips, contracts and building-project information among the files. The Senate expects citizens’ and companies’ data to be affected as well. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Coverage Gap at the Entry Point
The reported coverage gap matters because the system was not monitoring the devices involved in the intrusion. The urban development department told rbb24 that licenses covered 5% of its devices, and neither the PC identified as the attackers’ entry point nor the servers from which data was taken were included. That means the tool’s presence alone did not provide visibility across the systems central to this incident.
For people whose information was exposed, the publication of identity and employment records creates a continuing risk of targeted scams or misuse. For government agencies, the incident shows the potential consequences of incomplete monitoring: attackers may remain undetected while accessing files, and sensitive data can be copied before officials intervene. This is a practical security concern, not proof that broader coverage by itself would have prevented the attack.
The budget issue also warrants careful framing. Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. But the reporting does not establish that those cuts caused the department’s five-percent licensing level, or that the budget decisions directly produced the breach.
Products Worth Considering
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
Samsung 49-inch Odyssey OLED G9 (G91SD) Dual QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
Berlin’s official information page places the main data outflow between August 7 and 12 and says the state network was not attacked again after August 13. Officials detected the incident on August 14. According to Tagesspiegel reporting, the affected departments had to be informed by the state IT service provider, ITDZ. Berlin then isolated both departments from the network while the investigation and recovery work began.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. After the city declined Rhysida’s demand, the group posted the files on September 4. The Senate described the material as mostly unstructured employee-directory data; Hauer told a legislative committee that it carried no higher than the lowest of four classification levels. That classification does not mean the records were harmless: reporting on the leak identified personal and employment information, alongside government project material.
The limited detection coverage was disclosed in rbb24’s October investigation. The department said the system had been introduced in 2026 and that extending it to every device was not possible “for financial reasons”, translated from the department’s statement. Both affected departments had earlier told rbb that funding for IT security was available only partly to the required extent. Berlin’s information-security guideline has required authorities since 2017 to provide sufficient staff and funding, while a 2023 internal report had already called for systems to detect and defend against cyberattacks.
What the Investigation Has Not Established
The reporting identifies a serious coverage limitation but does not establish that the earlier budget reductions caused it. It also does not show that full device coverage would necessarily have stopped the intrusion or prevented data theft. Those are questions that require technical and budget records beyond the figures currently reported.
The complete contents and final number of exposed files also remain unsettled in public accounts: reports generally cite about 1.4 million files, while Hauer has cited roughly 1.3 million after a second batch. The Senate expects citizen and company information to be included, but the full set of affected people and organizations has not been publicly identified. The investigation has not established whether every exposed record was accessed or misused.
Recovery and Exposure Reviews Continue
Berlin must continue assessing what information was exposed, notifying affected people and organizations, and checking whether the published records have been used for fraud or other misuse. The public accounts cited here do not give a final count of affected individuals or a complete account of the recovery work. Further findings from the Senate, investigators or parliamentary scrutiny could clarify how the attackers entered, how long they had access and why key devices were outside the detection system.
People who may be affected should treat unexpected messages that use personal details with caution, verify claims through official channels and monitor bank statements. Berlin’s reported guidance also includes changing passwords, enabling two-factor authentication and reporting suspected misuse to police. These steps can reduce some risks, but they cannot remove information already posted online.
The next public milestones are any updated disclosure from Berlin on the scope of the breach and any explanation of plans to expand monitoring across government devices. Until those details are released, the link between budget decisions and the five-percent coverage level remains unproven.
Key Questions
What happened in the Berlin cyberattack?
Attackers stole data from Berlin’s urban development and mobility departments. The Senate says most of the data left between August 7 and 12, 2026; the attack was detected on August 14. Rhysida published files on September 4 after Berlin refused its ransom demand.
How many files were published?
Most reporting puts the number at about 1.4 million files. Chief Digital Officer Florian Hauer has cited roughly 1.3 million after a second batch, so the public figures differ.
Did security budget cuts cause the limited detection coverage?
That has not been established. Berlin’s 2025 budget cut funding for intrusion detection, but available reporting does not show that those cuts caused the department’s decision to license the system for only 5% of devices.
What can people do if their information may have been exposed?
Be cautious with messages that refer to personal details, verify requests through official channels, change passwords, enable two-factor authentication and monitor bank activity. Report suspected misuse to police.
Source: ThorstenMeyerAI.com
