🔍 Read the full analysis: Why The Savings Behind Berlin’s Rhysida Security Setup Matter on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster reported that Berlin’s attack-detection system covered licenses for just 5% of devices in one affected department, and neither the computer used to enter the network nor the servers involved in the data theft were covered. Rhysida published about 1.4 million files after Berlin refused its ransom demand. The reporting links the limited coverage to financial constraints, but does not establish that earlier budget cuts caused it.
Berlin’s cyberattack detection system covered licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing, according to an rbb24 investigation published October 21. Neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered, while the Rhysida ransomware group stole files from two Senate departments and later published them online.
The Senate says most of the data left the network between August 7 and 12, 2026; Berlin detected the attack on August 14. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. Berlin disconnected both from the state network as a safety measure, and some public services were limited while staff worked by phone, rbb24 reported.
Rhysida demanded 30 bitcoin, then worth about €2 million, according to the Senate Chancellery. Berlin refused to pay. On September 4, the group published the stolen files. The reported total is about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer described the volume as roughly 1.3 million after a second batch, while media reports generally cite 1.4 million.
Reporting by rbb24 and Tagesspiegel describes personnel records, scanned identity cards, payslips, contracts and building-project information among the exposed material. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and her stored digital signature in the leak; her department confirmed she was affected. The Senate says the data was mainly unstructured material from employees’ shared and personal directories, and expects information about residents and businesses may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Limited Coverage Matters
The five-percent figure matters because the detection system was not monitoring the devices implicated in the breach. Coverage is only useful where it exists: a system licensed for a small fraction of an organization’s devices cannot be assumed to alert staff to activity on the rest. In this case, according to rbb24, the entry computer and the servers from which information was taken were outside the covered group.
That gap is relevant beyond Berlin. Public agencies hold identity documents, personnel records and information about public infrastructure; a breach can expose people to fraud and compromise sensitive administrative material. The publication of Bonde’s ID and digital signature illustrates the personal risks, although the available reporting does not establish that the leaked signature has been misused.
The department told rbb that expanding the licenses to all devices was not possible “for financial reasons” (translated from the department’s statement). That makes the episode a test of how agencies weigh security spending against other demands. It does not, on its own, prove that spending more would have prevented this attack or identify the precise cost of full coverage. It does show that the protection in place did not extend to the systems involved.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Network Intrusion to Public Leak
Berlin made the incident public on August 17, three days after it was detected. The Senate’s information page says the main outflow took place August 7–12 and that the state network was not attacked again after August 13. A Tagesspiegel commentary reported that the departments were informed by the state IT service provider, ITDZ, that they had been hit.
In late August, Governing Mayor Kai Wegner confirmed Berlin was being blackmailed. After the city declined Rhysida’s demand, the group posted the files on September 4. The leak included records from different administrative functions; the Senate said the stolen material was mainly files kept in shared and personal directories rather than data from specialist applications. The Senate also said the material carried no higher than the lowest of four classification levels.
The detection system was introduced in 2026. The budget history provides relevant context but not a proven explanation: netzpolitik.org reported in November 2024 that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The sources do not establish that those changes caused the five-percent licensing coverage. An internal 2023 information-security report seen by rbb had already called for expanding systems to detect and defend against attacks earlier.
What the Coverage Figure Cannot Prove
The reporting does not establish why coverage stopped at 5% beyond the department’s statement that a wider rollout was not financially possible. It is also unclear how the 2025 budget changes relate to the licensing decision. The timeline does not prove that restoring the earlier funding, or covering every device, would have prevented the intrusion or the theft.
The full scope of exposed personal and business information remains uncertain. Berlin expects residents’ and companies’ data to be affected, but the available material does not identify every person or organization whose records were published. Reports put the file count at about 1.4 million, while Hauer gave a figure of roughly 1.3 million after a second batch. There is no confirmed account in the source material of misuse of the leaked identity documents or digital signature.
Follow-Up on Exposure and Security
Berlin’s immediate priorities are to determine who is affected, assess the exposed information and strengthen detection across the systems that handle government data. The source material does not give a deadline for a full review or confirm how many devices are now covered. Further public statements or investigative reporting may clarify the scale of exposure, the current status of the detection rollout and whether the city has changed its security funding.
People who may be affected should treat unexpected messages that appear to use personal details with caution. The advice cited in the source is to verify communications claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. These steps can reduce some risks, but do not establish whether a particular person’s information was included in the leak.
Key Questions
What happened in the Berlin Rhysida breach?
Berlin detected an intrusion on August 14, 2026, after most data had reportedly left the network between August 7 and 12. Rhysida demanded 30 bitcoin; Berlin refused, and the group published the files on September 4.
What does the 5% figure mean?
According to rbb24, licenses for the attack-detection system covered 5% of devices in the urban development department. The computer identified as the entry point and the servers from which data was taken were not covered.
What information was exposed?
Reports describe personnel records, scanned IDs, payslips, contracts and building-project information. The Senate expects that residents’ and businesses’ data may also be affected, but the complete list of affected people and records is not public in the source material.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget included cuts to intrusion detection and the IT service center, but available reporting does not prove those cuts caused the department’s five-percent coverage.
What should people potentially affected do?
Verify messages claiming to come from authorities, change passwords, turn on two-factor authentication, monitor bank statements and report suspected misuse to police. The source material does not confirm that all people whose data may have been exposed have been identified.
Source: ThorstenMeyerAI.com
