🔍 Read the full analysis: Rhysida’s Berlin Breach: The Trade-Off Behind 5% Device Detection on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole and published about 1.4 million files from two Berlin government departments after an intrusion in August 2026. An rbb24 investigation found that the detection system in the urban development department covered licenses for only 5% of devices, excluding the reported entry PC and the servers used to transfer data. The reasons for the limited coverage and whether broader coverage would have stopped the theft have not been established.
Berlin’s urban development department had licenses for a cyberattack detection system on only 5% of its devices when ransomware group Rhysida stole data from two state departments in August, according to an rbb24 investigation published in October. The department said broader coverage was not possible “for financial reasons”; rbb24 reported that neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered.
The Senate said the main data outflow took place from 7 to 12 August, and the attack was detected on 14 August. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. Berlin disconnected them from the state network as a precaution, and some public services were limited while staff worked by phone, rbb24 reported.
Rhysida demanded 30 bitcoin, valued at about €2 million, according to the Senate Chancellery. Berlin refused to pay, and the group published files on 4 September. Reports put the total at about 1.4 million files, although Chief Digital Officer Florian Hauer described the count as roughly 1.3 million after a second batch. The material included personnel records, scanned identity cards, payslips, contracts and building-project information, according to reports by rbb24 and Tagesspiegel.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature among the leaked files. Her department confirmed that she was affected. The Senate has said the stolen material was predominantly unstructured data from employees’ shared and personal directories, rather than data from specialist applications, and that citizens’ and companies’ information may also be affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Limited Detection Coverage Matters
The finding points to a gap between having security software and having it on the systems where an attack can be detected. In this case, rbb24 reported, the entry computer and data-transfer servers were outside the licensed coverage. That does not establish that broader coverage would have prevented the breach, but it raises questions about whether the system could provide useful visibility across the department’s network.
The exposure is not limited to government operations. Leaked identity and employment records can put individuals at risk of targeted scams or identity misuse, while building and infrastructure documents may contain sensitive operational details. The Senate expects data belonging to citizens and businesses to be among the stolen material, though the full scope has not been publicly confirmed.
For public agencies, the case illustrates the practical consequences of allocating security tools to only part of an organization. Detection coverage, logging and network separation can help identify suspicious activity while it is happening; the available reporting does not establish whether any one measure would have changed the outcome in Berlin.
Products Worth Considering
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Ledger Nano Gen5 Crypto Wallet, Black
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
The August Breach and September Leak
Berlin detected the intrusion on 14 August, after most of the reported data transfer had already occurred. The Senate said the state network was not attacked again after 13 August. The two departments were isolated from that network as officials investigated, and the Senate disclosed the incident publicly three days after detection.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The city did not meet Rhysida’s demand, and the files appeared online on 4 September after the deadline passed. Berlin’s information security guideline has required authorities since 2017 to provide adequate staff and funding for protection, according to the source report.
There is also a budget backdrop, but the link to the device-coverage decision is unproven. In 2024, Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. The source material does not establish that these cuts caused the department to license the system for only 5% of devices.
What the Coverage Figure Cannot Prove
The department’s reported 5% figure applies to its devices; the available reporting does not specify the total device count, how the percentage was calculated, or the coverage level in the second affected department. It is also not clear how the attackers entered the network beyond rbb24’s reporting that a particular computer was identified as the entry point.
Most importantly, the reports do not establish whether full device coverage would have detected the intrusion in time to prevent the theft. They also do not confirm that the 2025 budget cuts caused the limited licensing decision. Berlin has cited roughly 1.3 million files after a second batch, while other reports use about 1.4 million, and the complete number of affected people and organizations remains unknown.
The Senate said the files carried no more than the lowest of four classification levels, according to Hauer’s remarks to the Interior Committee. That classification does not by itself settle the privacy or security impact of the leaked personal records and infrastructure material.
Investigation and Exposure Response
Authorities and affected departments still need to clarify the scope of exposed personal and organizational data, how the attack progressed, and what security changes followed. The available source material does not give a public timetable for those findings or identify a next formal investigative milestone.
People who may be affected should treat unexpected messages claiming to come from Berlin authorities with caution. The source report relays official advice to verify such messages, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. These steps do not confirm that an individual was affected; the Senate’s broader review is needed to establish the reach of the leak.
The case also leaves a policy question for Berlin: whether detection coverage has since been extended and how the state will fund and monitor security across its devices. No subsequent coverage figures or completed remediation plan are provided in the source material.
Key Questions
What happened in the Berlin Rhysida breach?
Rhysida stole data from Berlin’s urban development and mobility departments in August 2026 and published files on 4 September after Berlin refused its ransom demand.
What does the 5% device figure refer to?
According to rbb24, licenses for the attack detection system in the urban development department covered 5% of its devices. The reported entry computer and the servers from which data flowed were outside that coverage.
How much data was published?
Most reports cited in the source material put the total at about 1.4 million files. Chief Digital Officer Florian Hauer gave a figure of roughly 1.3 million after a second batch, so the reported counts differ.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget included cuts to intrusion detection and the IT service center, but the source material does not show that those cuts caused the department’s licensing decision.
What should someone do if they may be affected?
Official advice cited in the source report is to verify messages claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. The full list of affected people has not been confirmed.
Source: ThorstenMeyerAI.com
