🔍 Read the full analysis: How Rhysida Breached Berlin’s Administration: AI, Attack Detection, And The Cost on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin says Rhysida stole and later published about 1.4 million files from two Senate departments after an intrusion in August 2026. An rbb24 investigation found that a cyberattack detection system in one department covered only 5% of its devices; the computers used to enter and remove data were outside that coverage. Berlin has not established that earlier budget cuts caused the limited rollout.
Rhysida stole data from two Berlin Senate departments in August 2026, and an attack detection system at one of them covered licenses for just 5% of devices, according to an rbb24 investigation. The computers identified as the attackers’ entry point and the servers from which data was taken were not covered, leaving key parts of the breach outside that system’s monitoring.
Berlin’s Senate says most of the data was copied between August 7 and 12. The administration detected the incident on August 14 and disconnected the affected departments from the state network as a precaution. The Senate made the attack public three days later. Rhysida demanded 30 bitcoin, described by Berlin as about €2 million; the city refused to pay. The group published the stolen files on September 4.
Reports put the leak at about 1.4 million files, although Berlin Chief Digital Officer Florian Hauer has also referred to roughly 1.3 million. rbb24 and other outlets reported that the material included personnel records, scanned identity cards, payslips, job references and contracts. The Senate said the files were predominantly unstructured data from employees’ shared and personal directories, rather than specialist applications. It expects data belonging to residents and companies may also be affected.
In an investigation published October 21, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and stored digital signature in the leaked material. Bonde’s department confirmed that she was affected. The same report found emails belonging to her predecessors. The Senate said the stolen files carried no higher than the lowest of four information-classification levels, but the contents described by reporters include personal and sensitive records.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
How Limited Monitoring Left Gaps
The reported coverage gap matters because detection tools can only alert defenders to activity on systems they monitor. In this case, according to rbb24’s account of the department’s response, the entry computer and data-bearing servers were outside the licensed 5%. The source material does not establish whether broader coverage would have prevented the theft, but it indicates that this system was not watching the devices central to the reported intrusion.
The breach also carries consequences beyond the immediate cost of response. Published identity and employment records can expose affected people to impersonation, targeted scams and misuse of personal information. Berlin has advised people to check messages claiming to come from public authorities, change passwords, use two-factor login where available, monitor bank statements and report suspected misuse to police.
For public agencies, the incident puts a practical question behind cybersecurity budgets: whether funding reaches the computers and servers that hold or handle sensitive information. The episode also disrupted services, as the departments were temporarily cut off from the state network and some citizen services were limited, according to rbb24. The available reporting does not quantify the full financial cost or the long-term impact on residents.
Popular right now
Shark Clean & Empty Cordless Stick Vacuum with Auto-Empty System, BU3521
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black
As an affiliate, we earn on qualifying purchases.
The Breach and Its Public Disclosure
The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s official incident information says the main outflow occurred from August 7 to 12 and that the state network was not attacked again after August 13. The incident was noticed on August 14. The Senate said the departments were isolated from the network while the response was underway.
Berlin’s budget history is part of the scrutiny but does not prove why the monitoring system covered only a fraction of devices. A November 2024 report by netzpolitik.org said the city’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The source material does not establish that these cuts caused the later five-percent coverage. Both departments had previously told rbb that funding for IT security was available only partly to the extent required.
Berlin’s information-security guideline has required authorities since 2017 to provide adequate staff and funding for protection, according to the source material. An internal 2023 security report, seen by rbb, had called for expanding systems to detect and defend against attacks earlier. Those earlier warnings provide context for the investigation, but do not by themselves establish which decisions led to the coverage gap in 2026.
What the Investigation Has Not Established
It is not established whether wider deployment of the detection system would have stopped the breach or changed how quickly it was discovered. The reported budget cuts provide financial context, but no confirmed causal link has been shown between those cuts and the five-percent license coverage. The source material also does not identify who approved the limited rollout or whether other security controls detected activity during the period when data was leaving the network.
The total and precise scope of exposed information remain unsettled. Reports cite about 1.4 million files, while Hauer has used a figure of roughly 1.3 million. Berlin expects that residents’ and companies’ data may be included, but the supplied information does not give a complete count of affected people or organizations. It is also unclear whether all exposed data has been accessed or copied by parties beyond Rhysida.
Berlin’s Response and Public Guidance
Berlin’s ongoing work includes examining the stolen material and notifying those affected, though the source material does not set out a complete timetable or the final number of people to be contacted. Further reporting or official updates may clarify the scope of the leak, how the intrusion unfolded and what monitoring was operating on the affected systems.
People whose information may be in the files should be alert to unexpected messages that use personal details or claim to come from an authority. Berlin’s stated guidance is to verify such messages independently, change passwords, enable two-factor login, monitor bank accounts and report suspected identity misuse to police. The central unresolved issue for the administration is whether its security coverage and funding will be expanded so that devices holding sensitive data are monitored.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says Rhysida accessed two Senate departments and copied data, mostly between August 7 and 12, 2026. The group demanded 30 bitcoin and published the files after Berlin refused to pay.
What did the leaked files contain?
Reports describe personnel records, identity documents, payslips, contracts and other material. The Senate said the files were mainly unstructured data from staff directories; it expects residents’ and companies’ information may also be involved.
What did rbb24 report about attack detection?
rbb24 reported that the detection system at the urban development department had licenses for just 5% of devices. The entry computer and servers from which data was taken were not covered, according to the report.
Did Berlin’s budget cuts cause the coverage gap?
That has not been established. Reports describe earlier reductions to security and IT budgets, but the available information does not prove those cuts caused the limited deployment in 2026.
What should people do if they may be affected?
Berlin advises people to verify messages claiming to be from authorities, change passwords, turn on two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
