🔍 Read the full analysis: Rhysida, Berlin, And The Cost Of Sparse Attack Detection on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole data from two Berlin government departments in August 2026 and published about 1.4 million files after the city refused a ransom demand. An rbb24 investigation found that attack-detection software in the urban development department covered licenses for only 5% of devices—and did not cover the identified entry computer or the servers from which data left.
Rhysida stole data from two Berlin state departments in August and later published about 1.4 million files after the city refused a ransom demand, while attack-detection software in one department covered licenses for only 5% of devices, according to an rbb24 investigation. The uncovered devices included the computer identified as the attackers’ entry point and the servers from which data was taken, raising questions about how Berlin’s security spending left key systems outside the detection net.
The Berlin Senate says most of the data left the network between August 7 and 12, 2026. The attack was noticed on August 14. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin disconnected both departments from the state network as a precaution; some services were limited while staff worked by phone, rbb24 reported. The Senate made the incident public on August 17.
In late August, Governing Mayor Kai Wegner confirmed the blackmail attempt. The Senate Chancellery said Rhysida demanded 30 bitcoin, described at the time as worth about €2 million. Berlin did not pay, and on September 4 the group posted the files online. Officials have cited roughly 1.3 million files, while most media reports put the total at about 1.4 million.
The published material reportedly includes personnel records, scanned identity cards, payslips and contracts, as well as documents about building projects and critical infrastructure. In an October investigation, rbb24 said the leak contained a copy of transport senator Ute Bonde’s ID card and a stored copy of her digital signature; her department confirmed she was affected. The Senate says the stolen files were predominantly unstructured data from staff directories, rather than data from specialist applications, and expects citizens’ and companies’ information may also be involved.
The investigation’s central finding concerns the department’s detection coverage. The urban development department told rbb that the system, introduced in 2026, had licenses for 5% of its devices. It said expansion to all devices was not possible “for financial reasons” (translated from German). The identified entry computer and the servers used to transfer data were not among the covered devices.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The coverage gap matters because a detection system can only alert defenders about activity on the devices it monitors. In this case, the specific computer identified as the entry point and the servers from which data flowed were outside the licensed coverage, according to rbb24. That does not establish that broader coverage would have prevented the theft, but it means the system was not positioned to observe activity on those machines.
The consequences extend beyond the city’s IT response. The leaked files reportedly include personal and employment information, and the Senate expects data belonging to residents and businesses may be affected. Exposure of identity documents or other personal details can create a risk of targeted impersonation or scam messages. The leak’s contents also include sensitive administrative and infrastructure-related records, according to reporting by rbb24 and Tagesspiegel.
For public agencies and other organizations, the case illustrates a practical distinction between buying security software and deploying it across the systems that matter. Coverage, logs and response capacity determine what defenders can see; a license count alone does not show whether key devices are monitored. The available information does not prove that limited coverage caused the breach or that a different budget would have stopped it.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Anker SOLIX C300 Portable Power Station, 288Wh
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The Senate’s account places the main data transfer between August 7 and 12, with no further attack on the state network after August 13. Berlin detected the incident the next day and isolated the departments. The delay between the reported data theft and detection left the city responding after most of the reported outflow had occurred.
The Senate’s information security guidance has required authorities since 2017 to provide adequate staffing and funding for protection. An internal 2023 information-security report, reviewed by rbb, had called for expanding systems to detect and defend against attacks. In 2024, both affected departments told rbb that funds for IT security were available only “partly to the required extent” (translated from German).
Berlin’s 2025 budget reduced €2 million from intrusion-detection funding and lowered the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. The connection between those budget reductions and the later decision to license detection software for only 5% of devices has not been established. The attack therefore sits alongside a documented funding debate, but the public record cited here does not show that the cuts directly produced the coverage limit.
What the Public Record Leaves Open
The full scope of the exposed data remains uncertain. The Senate expects that records belonging to citizens and companies may be affected, but the material cited in the reporting does not provide a complete count of people or organizations whose information was exposed. Published file totals also vary: officials have referred to roughly 1.3 million files, while many reports cite about 1.4 million.
It is also not established whether broader detection coverage would have identified the intrusion sooner, or whether earlier detection would have prevented the data transfer. The precise role of the 2025 budget reductions in the 5% licensing decision is unclear. Available accounts identify an entry computer and data-transfer servers outside the coverage, but do not set out a complete public technical account of how Rhysida accessed the network, what monitoring was operating elsewhere, or how much of the leaked material has been independently verified.
Follow-Up on Exposure and Security
Berlin’s next task is to clarify which individuals and organizations are affected and communicate any relevant protective steps. People who may be impacted should be wary of messages that use personal details to appear genuine. The source reporting relays official advice to verify communications claiming to come from authorities, change passwords, use two-factor login, monitor bank statements and report suspected misuse to police.
Further public reporting or official updates may clarify the exposed records, the city’s response and whether detection coverage has since changed. Berlin’s account of the incident and the investigation’s findings do not yet establish a direct link between specific budget reductions and the attack’s success. That question, along with the extent of the affected population, remains open.
Key Questions
What happened in the Rhysida attack on Berlin?
Rhysida stole data from two Berlin state departments in August 2026. The city detected the incident on August 14, refused a reported ransom demand, and the group published files online on September 4.
What did the investigation find about attack detection?
rbb24 reported that the urban development department’s detection system had licenses for 5% of devices. The computer identified as the entry point and the servers from which data left were not covered.
What information was published?
Reports describe personnel records, scanned ID cards, payslips, contracts and other administrative documents. rbb24 reported that the leak included a copy of transport senator Ute Bonde’s ID card and a stored digital signature; her department confirmed she was affected.
Did budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget cut funding for intrusion detection and the IT service center, but the available reporting does not prove those cuts caused the 5% licensing limit.
What should people who may be affected do?
Official advice reported by the source is to verify messages claiming to come from authorities, change passwords, turn on two-factor login, monitor bank statements and report suspected misuse to police. The full list of affected people is not yet clear.
Source: ThorstenMeyerAI.com
