🔍 Read the full analysis: Rhysida’s Attack On Berlin: A Case Study In Detection Coverage on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin authorities detected a Rhysida intrusion on August 14, 2026, after data had been copied from two Senate departments over several days. An rbb24 investigation reported that one department’s newly introduced detection system was licensed for only 5% of devices, excluding the PC identified as the entry point and the servers used to move data out. Berlin has not established that earlier budget cuts caused the limited coverage.
Berlin’s Rhysida ransomware attack exposed a gap in the city’s cyber defenses: an attack-detection system introduced in 2026 covered licenses for just 5% of devices in the Senate Department for Urban Development, Building and Housing, according to an rbb24 investigation published in October. The department said expanding coverage was not possible “for financial reasons”; the PC identified as the attackers’ entry point and the servers involved in data leaving the network were not covered.
The attack affected the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate says most of the data was taken between August 7 and 12. The intrusion was noticed on August 14, and the Senate made it public three days later. The departments were disconnected from the state network as a precaution, disrupting some services, rbb24 reported.
Rhysida demanded 30 bitcoin, described by the Senate Chancellery as worth about €2 million. Berlin refused to pay. On September 4, the group published stolen files online. The number reported varies: most coverage puts the total at about 1.4 million, while Chief Digital Officer Florian Hauer referred to roughly 1.3 million after a second batch.
The leaked material includes personnel records, scanned identity documents, payslips, job references and contracts, as well as files concerning building projects and critical infrastructure, according to rbb24 and Tagesspiegel reporting. The Senate says the material is mainly unstructured information from employee shared and personal folders, rather than data from specialist applications. It expects citizens’ and companies’ information to be affected as well.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why the Coverage Gap Matters
The case shows why the presence of security software does not, by itself, establish that an organization can detect an intrusion across its network. According to the rbb24 investigation, the devices most relevant to this incident—the suspected entry PC and the servers from which data left—were outside the system’s licensed coverage. That left the detection tool unable to observe those points, according to the reporting.
The timing also matters. The Senate’s account places most of the data transfer between August 7 and 12, several days before the attack was detected. That interval gave the attackers time to copy files before Berlin isolated the affected departments. For public agencies holding identity documents, personnel information and infrastructure plans, coverage decisions can affect both the speed of response and the amount of information exposed.
The incident is also relevant to people whose details may appear in the files. The Senate has said citizens and companies could be affected, but it has not publicly identified every person or record involved. People who receive messages that appear to use personal information from the leak should verify the sender through an official channel rather than relying on links or contact details in the message.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 24 Plus Monitor S2425HSM – 23.8 FHD (1920×1080) 144Hz 1ms, 2 x 3W Speakers, HDMI, Height/Tilt/Pivot/Swivel Adjustability, AMD FreeSync
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
Berlin’s chronology, as reported by the Senate and news outlets, runs from the data theft in early August to detection on August 14, a public announcement on August 17 and publication of the files on September 4 after the ransom deadline passed. The two departments were initially cut off from the state network and some citizen services were limited, rbb24 reported. The Senate said there was no further attack on the state network after August 13.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida had demanded 30 bitcoin; the city did not pay. The leak’s contents were subsequently examined by news organizations. In an October 21 report, rbb24 said it found a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature. Bonde’s department confirmed she was affected. The report also described emails belonging to her predecessors.
The detection-coverage findings are set against earlier concerns about funding, but the connection is not proven. In 2024, Berlin budget documents reduced €2 million from intrusion detection and cut the IT service center budget line from €32.2 million to €18.2 million, according to netzpolitik.org. The available reporting does not establish that those reductions caused the five-percent licensing level. Both affected departments had previously told rbb that funds for IT security were available only “partly to the required extent.”
What Berlin Has Not Established
The available reporting does not establish whether the 2024 budget reductions caused the department to license detection software for only 5% of its devices. The department cited financial reasons for not expanding coverage, but a direct link to a specific budget decision has not been documented in the source material.
The full scope of the stolen data is also unsettled. Reports put the leak at about 1.4 million files, while Hauer cited roughly 1.3 million after a second batch. File counts do not show how many people are affected, whether some files are duplicates, or how many records contain usable personal information. The Senate expects citizens and companies to be among those affected, but a complete accounting has not been reported.
Officials have said the stolen files carried at most the lowest of four classification levels. That does not resolve the potential consequences of publishing identity documents, personnel records, digital-signature material or information about infrastructure. The source material does not give a final assessment of misuse, financial losses or the full remediation costs.
Further Review and Public Precautions
Berlin still needs to clarify how many devices now have detection coverage, whether the gap has been closed, and what measures followed the investigation. The source material does not provide a timetable for a full review or a final report on affected records. Any assessment should distinguish the security system’s coverage from other protections, such as network logs and access controls, for which detailed findings are not provided here.
People concerned about exposure should follow official notices from Berlin, verify messages claiming to come from authorities, change reused passwords and use two-factor authentication where available. The source material also advises monitoring bank statements and reporting suspected misuse to police. These precautions do not establish that a particular person’s data was stolen; the extent of individual exposure remains unclear.
The next meaningful developments would be a fuller account from Berlin of the affected data and people, and a public explanation of the department’s detection coverage and any corrective steps. Until then, the reported five-percent figure and the uncovered entry and exit systems describe a serious coverage limitation, but not a complete technical reconstruction of how the attackers operated.
Key Questions
What happened in the Rhysida attack on Berlin?
Attackers copied data from two Berlin Senate departments, with most of the reported transfer occurring between August 7 and 12, 2026. Berlin detected the intrusion on August 14. Rhysida later published files online after the city refused its ransom demand.
What does the 5% detection figure refer to?
According to rbb24, the urban development department said licenses for its attack-detection system covered 5% of its devices. The reported entry PC and the servers involved in the data transfer were outside that coverage.
What information was published?
Reporting described personnel files, scanned identity cards, payslips, contracts and other records, alongside information about building projects and critical infrastructure. Berlin says the files were mainly unstructured material from employee directories. The complete inventory is not known.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, about €2 million. Berlin refused, and the group published the files on September 4, 2026.
Did budget cuts cause the limited coverage?
That has not been established. Berlin had made earlier IT-security budget reductions, but the available reporting does not prove those cuts caused the department’s five-percent licensing level.
Source: ThorstenMeyerAI.com
