🔍 Read the full analysis: Berlin’s Rhysida Attack: What Limited Monitoring Can Mean on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin says Rhysida stole and later published about 1.4 million files from two Senate departments after the city refused a 30-bitcoin ransom demand. An rbb24 investigation found the attack-detection system covered only 5% of devices in the urban development department, and neither the reported entry computer nor the servers involved were covered.
Berlin’s Rhysida ransomware attack exposed data from two Senate departments, and an October investigation by public broadcaster rbb24 found that an attack-detection system introduced in 2026 covered just 5% of devices in the urban development department. The department said extending coverage to all devices was not possible “for financial reasons”; the computer identified as the entry point and the servers from which data left were not covered.
The Senate says most of the data was copied between August 7 and 12, 2026. Berlin detected the attack on August 14 and isolated the affected departments from the state network. The incident affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. The Senate made the attack public three days after detecting it.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then valued at about €2 million. Berlin refused to pay, and the group published files on September 4. Authorities and media reports have put the leak at roughly 1.3 million to 1.4 million files, with most reports using the higher figure.
Reported material includes personnel records, scanned identity cards, payslips, contracts and building-project information. The Senate said the data consisted predominantly of unstructured files from employees’ shared and personal directories, rather than information taken from specialist applications. The Senate expects citizens’ and companies’ data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported gap matters because detection tools can only alert defenders to activity on the systems they cover. In this incident, rbb24 reported that neither the computer identified as the attackers’ entry point nor the servers involved in the data transfer were covered by the system’s licenses. The available information does not establish that wider coverage would certainly have stopped the theft, but it shows how limited deployment can leave key parts of a network outside that layer of monitoring.
The consequences extend beyond government operations. Leaked identity and employment information can expose affected people to impersonation or targeted scams, while building and infrastructure records may carry security concerns. Berlin’s departments were disconnected from the state network after the incident, and rbb24 reported that some citizen services were limited while staff worked by phone. The scale of the leak and the presence of sensitive records make the incident relevant to both public services and people whose information may appear in the files.
The case also raises a public-spending question, but the available reporting does not prove that earlier budget reductions caused the coverage gap. Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org in November 2024. Those figures provide budget context, not proof of a direct link to the licensing decision.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
According to the Senate’s account, the main data outflow occurred from August 7 through August 12, and the state network was not attacked again after August 13. Berlin detected the incident on August 14. The two departments were disconnected as a precaution, and the state disclosed the attack publicly on August 17. A Tagesspiegel report said the departments were informed by the state IT service provider, ITDZ, that they had been hit.
The ransom demand was made public in late August. After Berlin declined to pay, Rhysida posted the stolen files online on September 4. The October rbb24 investigation then drew attention to the monitoring system’s limited licensing and identified personal material in the leak. Its reporting followed earlier warnings: both departments told rbb that funding for IT security in 2024 was available only partly to the extent required. An internal 2023 information-security report reviewed by rbb had called for expanded systems to detect and defend against cyberattacks. Berlin’s information-security guideline has required authorities since 2017 to provide adequate resources for protection.
Open Questions on Scope and Cause
The full number of people and organizations affected has not been established in the available reporting. The Senate expects that citizens’ and companies’ information is included, but it has not provided a complete public accounting of whose data was exposed. Reported file totals vary, with accounts citing approximately 1.3 million or 1.4 million.
It is also not established that the limited monitoring coverage caused the breach or that broader coverage would have prevented it. The reporting identifies systems outside the licensed coverage, but does not detail every security control in place or what alerts those controls generated. Nor is a direct causal link established between the 2025 budget reductions and the five-percent coverage reported by rbb24.
The published files may contain information beyond the examples identified by journalists. The Senate’s description of the data and the reporting on individual records show the sensitivity of some material, but the full contents and the extent of any subsequent misuse remain unclear.
Further Disclosure and Public Safeguards
Berlin’s departments and investigators will need to clarify the affected data, inform people and organizations whose records were exposed, and explain what changes are planned for monitoring coverage and other safeguards. The available source material does not give a deadline for a complete impact assessment or a full expansion of the detection system.
People concerned about exposure should treat unexpected messages claiming to come from government offices with caution, verify them through official channels, change reused passwords, enable two-factor authentication where available, monitor bank activity and report suspected misuse to police. These steps reduce some risks but cannot remove information already published. Further reporting or official notices may provide a clearer account of the victims, the response and any confirmed misuse.
Key Questions
What happened in the Berlin Rhysida attack?
Berlin detected a ransomware attack on August 14, 2026, affecting two Senate departments. The Senate says most data was taken between August 7 and 12; Rhysida published stolen files on September 4 after Berlin refused its ransom demand.
What does the 5% monitoring figure refer to?
According to rbb24, the attack-detection system introduced in 2026 had licenses for 5% of devices in the urban development department. The reported entry computer and the servers from which data left were not covered.
What information was exposed?
Reports describe personnel files, scanned ID cards, payslips, contracts and building-project records. The Senate says the data was mainly unstructured material in employee directories and expects that citizens’ and companies’ data may also be affected.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, then valued at about €2 million. Berlin refused, and the group published the files on September 4.
Has the monitoring gap been proven to cause the breach?
No. The reporting shows that the system did not cover the reported entry computer or the servers involved in the data transfer. It does not establish that wider coverage would have prevented the attack or that budget cuts caused the limited licensing.
Source: ThorstenMeyerAI.com
