🔍 Read the full analysis: Berlin’s Rhysida Incident: Why Attack Detection Coverage Matters on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin’s Senate departments for urban development and transport were hit by a Rhysida ransomware attack in August 2026, and the group published about 1.4 million files after the city refused its ransom demand. An rbb24 investigation reported that attack-detection software covered only 5% of devices in the urban development department, excluding the reported entry computer and servers involved in the data theft.
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused a ransom demand, according to Berlin authorities and media reports. An October investigation by rbb24 found that the attack-detection system in the urban development department was licensed for only 5% of devices, and did not cover the reported entry computer or the servers from which data was taken.
The Senate said most of the data left the network between August 7 and 12; the attack was noticed on August 14. The affected offices were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin disconnected both from the state network as a safety measure, temporarily limiting some public services, rbb24 reported.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said the attackers demanded 30 bitcoin, then valued at about €2 million. Berlin did not pay, and Rhysida published files on September 4 after the deadline. Chief Digital Officer Florian Hauer described the total as roughly 1.3 million files after a second batch; other reports, including rbb24 and Tagesspiegel, put the number at about 1.4 million.
Reporting on the leak identified personnel records, scanned identity cards, payslips, contracts and building-project information. Tagesspiegel also reported birth certificates belonging to employees’ children and rehabilitation records. The Senate described the material as mainly unstructured data from staff shared and personal folders, rather than specialist applications, and said data belonging to citizens and companies may also be affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert defenders to activity on systems they monitor. In this incident, rbb24 reported that the computer identified as the entry point and the servers from which information was taken were outside the licensed 5% of devices. The department told the broadcaster that extending coverage was not possible “for financial reasons” (translated from German).
The breach also has direct consequences for people whose records were exposed. Leaked identity and employment information can be used in targeted impersonation attempts. Berlin’s advice, as described in the source reporting, is to verify messages that claim to come from authorities, change passwords, use two-factor login, check bank statements and report suspected misuse to police.
For public agencies and other organizations, the case puts a practical question in focus: whether security budgets cover the systems that hold or handle sensitive information. The incident does not establish that broader detection coverage would have stopped the attack, but the reported exclusions show how limited deployment can leave important parts of a network outside monitoring.
Products Worth Considering
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Anker SOLIX C300 Portable Power Station, 288Wh
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker, Black
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
Berlin made the incident public on August 17, three days after it was detected. The Senate said the state network was not attacked again after August 13. The two departments were initially cut off from that network while the response was under way. The published files followed the city’s refusal to pay Rhysida’s demand.
On October 21, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and her stored digital signature in the leaked material. Bonde’s department confirmed she was affected. The broadcaster also reported emails belonging to her predecessors. The Senate said the stolen files carried no higher than the lowest of its four classification levels, while also warning that citizen and company data could be present.
The budget figures offer context but do not establish why detection licenses covered only a small share of devices. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center’s budget line from €32.2 million to €18.2 million. The available information does not show that these cuts caused the limited rollout.
Scope and Cause Still Unsettled
The full number of affected people and organizations is not established, and the Senate has said citizen and company data may be included. Published totals also vary: Hauer’s reported estimate was roughly 1.3 million files after a second batch, while multiple outlets have cited about 1.4 million. File counts do not show how many individuals were affected.
It is also unclear whether Berlin’s budget reductions caused the five-percent coverage level. The reporting links the limited licensing to financial constraints, but the cited budget figures alone do not establish a direct connection. The available source material does not detail how the attackers first gained access, the precise amount or sensitivity of all exposed data, or whether every affected person has been identified and notified.
Notifications and Security Review
Berlin’s departments and security authorities will need to continue assessing the published files, identifying affected individuals and organizations, and advising them about risks. People who may be affected can follow official guidance: verify messages claiming to come from public agencies, change exposed or reused passwords, enable two-factor authentication, monitor bank activity and report suspected misuse to police.
The public reporting also leaves a policy issue for Berlin: whether detection coverage will be extended and how authorities will fund monitoring across devices that hold or move sensitive information. The supplied material does not give a timetable for broader deployment or a final account of the incident’s impact.
Key Questions
What happened in the Berlin Rhysida incident?
Attackers stole files from two Berlin Senate departments in August 2026. Rhysida published about 1.4 million files on September 4 after Berlin refused a demand for 30 bitcoin.
What did the rbb24 investigation find about detection coverage?
rbb24 reported that the detection system in the urban development department had licenses for 5% of devices. The reported entry computer and servers involved in the data theft were not covered.
What information was in the leaked files?
Reports identified personnel records, scanned identity cards, payslips, contracts and building-project information. The Senate said the files were mainly unstructured material from employee directories; the full scope and number of people affected remain unclear.
Did Berlin’s budget cuts cause the coverage gap?
That has not been established. Reporting cited earlier reductions to intrusion-detection and IT service-center budgets, but the available information does not demonstrate that those cuts caused the 5% license coverage.
What should people do if their information may have been exposed?
Berlin’s reported advice is to verify messages claiming to come from authorities, change passwords, enable two-factor login, check bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
