🔍 Read the full analysis: How Much Does Limited Device Detection Cost? Berlin’s Rhysida Case on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin authorities detected a Rhysida ransomware attack on 14 August 2026, after most of the data theft had occurred. An rbb24 investigation reported that an attack-detection system introduced that year covered just 5% of devices in one affected department; Berlin said wider coverage was not possible for financial reasons. The attackers later published about 1.4 million files, while the precise role of budget cuts in the limited coverage remains unestablished.
Berlin’s attack-detection system covered licenses for just 5% of devices in the Senate Department for Urban Development, Building and Housing when the Rhysida ransomware group stole data from two state departments in August, according to an rbb24 investigation. Berlin said extending coverage was not possible “for financial reasons”; the incident exposed sensitive records and led to the publication of about 1.4 million files after the city refused a ransom demand.
The Berlin Senate said the main data transfer took place between August 7 and 12, and the attack was detected on August 14. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a precaution, with some citizen services temporarily limited, rbb24 reported. Berlin made the incident public on August 17.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said the attackers demanded 30 bitcoin, then worth about €2 million. Berlin did not pay. Rhysida posted the stolen files online on September 4, after its deadline passed. Officials and media accounts have described the haul as roughly 1.3 million to 1.4 million files; about 1.4 million is the figure reported by most outlets.
The disclosed material includes scanned identity documents, personnel files, payslips, job references and contracts, according to reporting by rbb24 and Tagesspiegel. The Senate described the files as predominantly unstructured data from employee shared and personal directories and said citizens and companies may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature in the leak. Her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert defenders to activity on systems they monitor. In this case, rbb24 reported that neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered by the licenses. That meant the system was not watching the devices central to the breach, according to the investigation.
The episode gives a concrete example of how a security budget decision may shape an organization’s ability to spot an intrusion. Berlin said wider coverage was unaffordable, but the available reporting does not establish that the later budget cuts directly caused the five-percent limit. The confirmed consequence is more specific: the monitoring system had limited reach, and the theft continued for several days before officials detected it.
For people whose records were exposed, the risk is not confined to the initial leak. Identity details and other personal information can make fraudulent messages seem credible. Berlin’s official advice, as reported in the source material, is to verify messages claiming to come from authorities, change passwords, activate two-factor login, monitor bank statements and report suspected misuse to police.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The Senate’s account places the main outflow between August 7 and 12, with no further attack on the state network after August 13. Berlin’s administration noticed the incident on August 14. A Tagesspiegel commentary said the departments had to be informed by the state IT service provider, ITDZ, that they had been hit. Officials then isolated both departments from the network while investigating.
The detection coverage became a public issue through rbb24’s October reporting. The urban development department told the broadcaster that its detection system, introduced in 2026, had licenses for only 5% of devices and could not be extended for financial reasons. The report also noted that Berlin’s 2025 budget reduced intrusion-detection funding by €2 million and cut the IT service center budget line from €32.2 million to €18.2 million. Those figures provide budget context, but they do not establish which decision produced the department’s limited license coverage.
Berlin’s information-security guideline has required authorities since 2017 to provide sufficient resources for protection, according to the source material. An internal 2023 security report reviewed by rbb had already proposed expanding systems to detect and defend against cyberattacks. These earlier measures and plans show that detection capacity was under discussion before the 2026 incident; they do not, on their own, prove that the breach would have been prevented with broader coverage.
“Extending the system to all devices was not possible “for financial reasons.””
— Berlin’s urban development department, responding to rbb
Open Questions on Scope and Cause
The full set of people and organizations whose information was exposed is not yet clear. The Senate said citizens and companies may be affected, while reports identified specific personal and employment records. The exact number of files is also described differently: Chief Digital Officer Florian Hauer referred to roughly 1.3 million after a second batch, while many reports cite about 1.4 million.
It is also not established whether the budget reductions cited in reporting caused the five-percent device coverage, or whether broader monitoring would have detected the intrusion before the data was copied. The source material does not provide a full technical account of how the attackers gained access, how long they had access before August 7, or the final results of the investigation into the incident.
Investigation and Victim Guidance
Berlin authorities still face the task of determining whose data appears in the published files and informing affected people and organizations. Further public updates on the investigation, remediation and any changes to device-monitoring coverage will help clarify whether the gaps identified by rbb24 have been addressed.
People who think their information may be involved can follow the authorities’ reported guidance: check that messages claiming to be from government offices are genuine, change passwords, use two-factor authentication, monitor bank activity and report suspected identity misuse to police. The supplied material does not give a date for a final investigation report or a complete accounting of affected individuals.
Key Questions
What happened in the Berlin Rhysida case?
Rhysida stole data from Berlin’s Senate departments for Urban Development and Mobility in August 2026. Berlin detected the incident on August 14, refused a ransom demand, and the group published the files on September 4.
How much of the affected department’s equipment was monitored?
According to rbb24, the detection system had licenses for 5% of devices in the urban development department. The department said it could not extend coverage for financial reasons. The entry computer and the servers involved in the data transfer were reportedly outside that coverage.
What information was exposed?
Reports identified personnel files, scanned ID cards, payslips, job references, contracts and other records. The Senate said the material was mainly unstructured data from employee directories and warned that citizens and companies may also be affected.
Did Berlin’s budget cuts cause the detection gap?
That has not been established. Reporting cited cuts to Berlin’s 2025 intrusion-detection and IT service center budgets, but the available information does not show that those cuts directly caused the department’s five-percent coverage.
What should people do if they may be affected?
Berlin’s reported advice is to verify messages claiming to come from authorities, change passwords, activate two-factor login, watch bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
