🔍 Read the full analysis: Rhysida’s Berlin Entry: The Role Of Detection Across Devices on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole files from two Berlin government departments in August 2026 and published them on September 4 after the city refused a ransom demand. An rbb24 investigation reported that an attack-detection system at one department covered licenses for only 5% of devices, excluding the PC and servers involved in the breach. The precise effect of that coverage gap on the attack’s duration or scale has not been established.
Rhysida stole data from two Berlin government departments in August 2026, and an October investigation by public broadcaster rbb24 found that the detection system at one department was licensed for only 5% of its devices. The urban development department told rbb that expanding coverage was not possible “for financial reasons”; the PC identified as the attackers’ entry point and the servers from which data left were outside the covered group.
Berlin’s Senate says the main data transfer took place between August 7 and 12, and the attack was noticed on August 14. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a precaution, and some services were limited while staff worked by phone, rbb24 reported. The Senate made the incident public three days after it was detected.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin declined to pay, and the group published the files on September 4. Officials have described the collection as roughly 1.3 million files; reports including rbb24 and Tagesspiegel have put the total at about 1.4 million.
Reporting on the leaked material identified personnel records, scanned identity documents, payslips, contracts, job references and information about building projects and critical infrastructure. The Senate said the files were predominantly unstructured data from employee shared and personal directories, rather than specialist applications, and said citizen and company data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak. Her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Device Coverage
The reported coverage gap matters because detection tools can only alert on activity they can see. In this case, according to rbb24’s account of the department’s response, the identified entry PC and the servers used to transfer data were both outside the licensed group. That does not establish that broader coverage would have prevented the intrusion or stopped the theft, but it leaves a direct operational question: whether better monitoring could have helped officials identify suspicious activity earlier.
The breach also shows the potential reach of stolen files beyond government operations. Identity documents, employment records and other personal information can be used in convincing impersonation or scam attempts. The city’s response and the extent of exposure matter to employees, residents and businesses whose information may be among the files. The Senate has said citizen and company data is expected to be affected, but the source material does not provide a complete accounting of whose records were exposed.
For public agencies and other organizations, the case is a reminder that purchasing a security tool and deploying it across the systems that matter are separate steps. Coverage of a small share of devices may leave important endpoints unmonitored. The available reporting does not show that the licensing limit alone caused the breach, or quantify what broader coverage would have changed.
Products Worth Considering
Withings BPM Connect Wi-Fi and Bluetooth Blood Pressure Monitor
Garmin Forerunner 570 GPS Running Smartwatch, 47mm, Aluminum, Black
Levoit Core 400S-P Smart Air Purifier for Large Rooms
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
The Senate’s timeline places the main data outflow between August 7 and 12, with the incident detected on August 14. The state network was not attacked again after August 13, according to the Senate’s official information page. Once the departments were isolated, Berlin investigated the incident and dealt with the extortion demand. The publication of the files followed after the city refused to pay.
The detection system was introduced in 2026, according to the urban development department’s account to rbb24. The department said licenses covered only 5% of its devices and that full coverage could not be funded. Berlin’s budget history provides context, but not proof of why that particular limit was set: netzpolitik.org reported that the 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available information does not establish that those cuts caused the five-percent coverage level.
Earlier concerns about security funding had also been reported. In 2024, both affected departments told rbb that resources for IT security were available only partly to the required extent. An internal information-security report from 2023, seen by rbb, had planned expansion of systems intended to detect and defend against cyberattacks. These details provide a funding and planning backdrop; they do not by themselves explain the decisions behind the system’s eventual deployment.
What the Coverage Gap Can Prove
The reporting identifies a coverage gap and says the entry PC and data-transfer servers were not covered, but it does not establish that this was the sole reason the attack went undetected. It is also unclear from the available material whether broader monitoring would have detected the intrusion in time to prevent the data from being copied, or how long attackers had access before the main outflow.
The full contents and final number of exposed files remain uncertain: officials have cited roughly 1.3 million, while several reports give about 1.4 million. The Senate expects citizen and company data to be included, but a complete list of affected people or records has not been published in the source material. The relationship between Berlin’s budget reductions and the five-percent licensing decision has not been established either.
Investigation and Advice for Those Affected
Berlin’s authorities still need to determine the full scope of the exposed data, identify affected individuals and organizations, and explain how detection and monitoring are being addressed after the incident. The material provided does not state a date for a completed investigation or a specific deadline for expanding the system’s coverage.
People who may be affected should be alert to messages that use personal details to appear credible. The source material advises verifying any message claiming to come from an authority, changing passwords, enabling two-factor login, checking bank statements and reporting suspected misuse to police. Those steps are general precautions; the available reporting does not say that every person whose data appeared in the leak will be targeted.
Key Questions
What happened in the Berlin cyberattack?
Rhysida accessed data from two Berlin Senate departments in August 2026. After Berlin refused a ransom demand, the group published files online on September 4.
What did the report say about detection coverage?
rbb24 reported that the attack-detection system at the urban development department had licenses for 5% of devices. The identified entry PC and the servers from which data was taken were not covered.
What information was reportedly exposed?
Reports describe personnel files, scanned ID cards, payslips, contracts and project information. The Senate said the data was mainly unstructured material from employee directories and expects citizen and company data may also be affected.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused, and the files were published on September 4.
What should someone do if they may be affected?
Be cautious with messages that use personal details, verify communications claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
