🔍 Read the full analysis: What Berlin’s Administration Saved—and Spent—After Rhysida on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s administration says a cyberattack exposed data from two Senate departments, and a public broadcaster reported that detection software at one department covered licenses for only 5% of its devices. Rhysida published about 1.4 million files after Berlin refused its ransom demand; the precise link between budget cuts and the limited software coverage has not been established.
Berlin’s administration had attack-detection software licensed for only 5% of devices in its Senate Department for Urban Development, Building and Housing, according to an investigation by public broadcaster rbb24. The finding follows an August cyberattack on that department and the Senate Department for Mobility, Transport, Climate Protection and Environment, after which the Rhysida ransomware group published about 1.4 million files online.
The Senate said most of the data theft took place between August 7 and 12, 2026, and the attack was detected on August 14. Berlin’s state IT service provider isolated the two departments from the state network as a precaution. Their services were disrupted, and some citizen services were limited, rbb24 reported. The Senate made the incident public three days after detection.
Berlin later confirmed that Rhysida demanded 30 bitcoin, valued at about €2 million, and that the city refused to pay. The group published files on September 4, after its deadline. The Senate’s Chief Digital Officer, Florian Hauer, described the stolen material as roughly 1.3 million files after a second batch; several reports, including rbb24’s, put the total at about 1.4 million.
Reporting on the leak identified personnel records, scanned identity cards, payslips, contracts and building-project information. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature; Bonde’s department confirmed she was affected. The Senate says the files were mainly unstructured material from staff shared and personal directories. It expects citizens’ and companies’ data may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The reported coverage gap matters because software cannot alert administrators to activity on devices it does not monitor. In this incident, rbb24 reported that neither the PC identified as the attackers’ entry point nor the servers from which data later left were covered by the licenses. The department told the broadcaster that extending coverage to all devices was not possible “for financial reasons”, translated from its German statement.
The episode also has direct consequences for people whose records were exposed. Leaked identity and employment information can be used in targeted impersonation attempts or scams. The available reporting does not establish that every person whose data may have been involved has been identified, so recipients should treat unexpected messages claiming to come from authorities with care and verify them through official channels.
For public agencies, the incident puts a concrete security decision alongside the consequences of a major breach: what systems were monitored, and what remained outside coverage. It does not, on its own, show that broader software coverage would have prevented the theft. It does show that the devices named in reporting as the entry point and data-exfiltration route were not within the licensed portion.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
The Senate’s account places the main data outflow between August 7 and 12; officials detected the incident on August 14. The two departments were disconnected from the state network, and the Senate disclosed the attack publicly on August 17. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The city declined the demand, and Rhysida published files on September 4.
Berlin had previously identified funding pressures in IT security. In 2024, the two departments told rbb that funds for security needs were available only partly to the required extent. A 2025 budget proposal cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org’s November 2024 reporting. Those figures provide budget context, but the available information does not establish that the cuts caused the five-percent coverage reported by rbb24.
Open Questions on Coverage and Exposure
It is not clear from the available reporting why licenses covered only 5% of devices, how that coverage was selected, or whether the remaining devices had other forms of monitoring. The department cited financial reasons for not expanding coverage, but the available sources do not connect that decision directly to the 2025 budget reductions. Nor do they establish that full coverage would have detected or stopped this particular attack.
The full number of affected people and organizations remains uncertain. The Senate expects citizens’ and companies’ data to be involved, while the published files contain material relating to staff and government projects. The exact contents, total number of affected records, and potential misuse have not been fully established in the supplied reporting. The Senate said the stolen files carried no higher than the lowest of its four classification levels; that classification does not resolve the privacy risks to people named in the documents.
Notification and Security Follow-Up
The next steps are for Berlin to continue determining whose information was exposed, notify affected people and organizations as appropriate, and explain what changes it will make to monitoring and network security. The supplied reports do not give a timetable for a complete investigation or say when detection coverage will be expanded.
People who may be affected should be alert to messages that use personal details to appear genuine. Berlin’s published advice includes verifying communications that claim to come from authorities, changing passwords, enabling two-factor login, checking bank statements and reporting suspected misuse to police. The extent of any identity theft or other use of the leaked material remains unclear.
Key Questions
What happened to Berlin’s government departments?
Rhysida gained access to systems at two Senate departments and copied data, with most of the reported outflow occurring between August 7 and 12, 2026. Berlin detected the attack on August 14 and isolated the departments from the state network.
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for the attack-detection system at the urban development department, according to rbb24. The broadcaster reported that the identified entry PC and the servers from which data left were outside that coverage.
What information was published?
Reports describe personnel files, scanned IDs, payslips, contracts and building-project information among about 1.4 million files. The Senate expects citizens’ and companies’ data may also be affected, but the full scope has not been confirmed.
Did Berlin pay Rhysida?
No. Berlin refused the group’s demand for 30 bitcoin, about €2 million. Rhysida published the files on September 4 after the deadline passed.
Did budget cuts cause the limited detection coverage?
That has not been established. Berlin’s 2025 budget included reported cuts to intrusion detection and the IT service center, but the available reporting does not show that those cuts directly caused licenses to cover only 5% of devices.
Source: ThorstenMeyerAI.com
