🔍 Read the full analysis: Mapping The Detection Gaps In Rhysida’s Attack On Berlin on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate Department for Urban Development, Building and Housing told rbb that a cyberattack detection system introduced in 2026 had licenses for only 5% of its devices. Neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered. Rhysida published about 1.4 million files after Berlin refused a ransom demand; the extent of harm to people and organizations remains unclear.
Berlin’s Senate Department for Urban Development, Building and Housing told broadcaster rbb that a cyberattack detection system introduced in 2026 had licenses for just 5% of its devices when Rhysida stole data from the state network. According to the department, neither the computer identified as the attackers’ entry point nor the servers from which data left were covered. The disclosure helps explain a major gap in monitoring during an attack that ended with about 1.4 million files published online.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate said the main outflow of data took place between August 7 and 12, 2026. Authorities detected the incident on August 14 and disconnected both departments from the state network as a precaution, disrupting some services, rbb24 reported. The Senate made the attack public three days later.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused to pay, and the group published files on September 4 after its deadline passed. Reports put the total at about 1.4 million files, though Chief Digital Officer Florian Hauer described the amount as roughly 1.3 million after a second batch.
The material reported in the leak includes personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate said the files were mainly unstructured data from employees’ shared and personal directories, rather than specialist applications, and expects citizens’ and companies’ data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature; Bonde’s department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Monitoring Gap With Human Costs
The reported coverage figure matters because an alerting tool cannot identify activity on devices it does not monitor. In this case, the department told rbb that the suspected entry computer and the servers used to move data out were outside the system’s licensed coverage. That does not by itself establish why the attack succeeded, but it identifies a concrete limitation in the department’s ability to see activity across its network.
The consequences reach beyond government IT. Leaked identity documents and employment records can expose people to impersonation or targeted scams, while information about buildings and infrastructure may create security concerns. The Senate has said it expects data relating to citizens and companies to be among the stolen material, but the available reporting does not establish the full list of affected people or the misuse, if any, of particular files.
The case also raises questions for public agencies deciding how to fund cyber defenses. A monitoring system installed on a small fraction of devices may provide less visibility than its presence suggests. The report makes coverage, logging and network access controls relevant questions for Berlin’s response, without proving that budget decisions alone caused the breach.
Popular right now
Shark PowerDetect Corded Stick Vacuum with HEPA Filtration, Purple (HZ4001AMZ)
Dyson V8 Cyclone Cordless Vacuum
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
Attack Timeline and Budget Record
The Senate’s account places the main data theft between August 7 and 12, with no further attack on the state network reported after August 13. Berlin detected the incident on August 14. The two departments were disconnected from the network while officials responded, and some services were limited. The ransom demand and subsequent publication came after the main theft, so the leak was not the first indication of the intrusion.
The detection coverage disclosure emerged in rbb24’s October investigation. The urban development department said extending licenses to every device was not possible “for financial reasons,” according to the source material’s translation. A separate budget report by netzpolitik.org in November 2024 said Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center budget line from €32.2 million to €18.2 million. The available information does not establish that those cuts caused the 5% coverage.
There were earlier warnings about resources and detection. Both departments told rbb in 2024 that funds for IT security were available only “partly to the required extent,” according to the source material’s translation. An internal 2023 information-security report, seen by rbb, called for expanding systems to detect and defend against cyberattacks. Berlin’s information-security guideline has required authorities since 2017 to provide adequate staff and funding for protection.
What the Leak Still Does Not Show
The complete contents of the published files and the number of people whose information is exposed have not been established in the source material. The Senate expects citizens’ and companies’ data to be affected, but it has not provided a full accounting here. Reports also differ slightly on the total number of files: about 1.4 million is the figure used by most outlets, while Hauer cited roughly 1.3 million after a second batch.
It remains unclear whether stolen information has been used for fraud, whether all copies have been found, and how long attackers had access before the main data outflow. The 5% license figure is reported for the urban development department; the source does not give an equivalent coverage figure for the transport department. Nor does the available evidence establish that the 2025 budget reductions caused the monitoring gap or that broader coverage would, on its own, have prevented the theft.
Berlin’s Review and Public Response
Berlin’s next steps include determining which individuals and organizations are affected and communicating relevant risks. People who may have had information exposed should be alert to messages that use personal or employment details to appear credible. The source material advises verifying messages claiming to come from authorities, changing passwords, using two-factor login, checking bank statements and reporting suspected misuse to police.
Further reporting and official updates will be needed to clarify the full scope of the leak and any response to the monitoring shortfall. Key details to watch include whether Berlin expands detection coverage, what systems are now monitored, and whether officials publish findings about how the attackers moved through the network. No specific timetable for those steps is provided in the source material.
Key Questions
What did the rbb24 investigation report about Berlin’s detection system?
The urban development department told rbb that licenses for its attack-detection system covered 5% of devices. It said the suspected entry computer and the servers from which data left were not covered.
What information did Rhysida publish?
Reports described about 1.4 million files, including personnel material, scanned identity documents, payslips, contracts and building-project information. The Senate said the files were mainly unstructured data from employee directories and expects citizens’ and companies’ data may also be affected.
Did Berlin pay Rhysida’s ransom demand?
No. The Senate Chancellery said the group demanded 30 bitcoin, about €2 million at the time. Berlin refused, and Rhysida published the files on September 4, 2026.
Did budget cuts cause the detection gap?
That has not been established. Reporting described cuts to Berlin’s intrusion-detection and IT service center budgets, but the available information does not prove those cuts caused the department’s 5% coverage.
What should people do if they may be affected?
Be cautious with messages that cite personal details, verify claims that a message comes from an authority, change passwords, use two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
