🔍 Read the full analysis: The Security Trade-Off Behind Rhysida’s Berlin Breach on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole and later published about 1.4 million files from two Berlin government departments after data flowed out for several days in August 2026. An rbb24 investigation reported that attack-detection software in one department covered only 5% of its devices, excluding the computer and servers involved in the breach. Berlin’s refusal to pay the ransom and the resulting leak are confirmed; the extent of harm and whether budget cuts caused the coverage gap remain unclear.
Rhysida stole data from two Berlin government departments in August 2026 and published the files after the city refused a ransom demand, while an rbb24 investigation found that attack-detection software in one department covered only 5% of its devices. The reported coverage gap matters because the computer identified as the attackers’ entry point and the servers from which data was taken were not covered by the system.
According to the Berlin Senate and rbb, the main outflow of data took place between August 7 and 12. The attack was noticed on August 14, and the Senate made it public three days later. The two affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Officials disconnected them from the state network as a precaution; rbb24 reported that some services were limited and staff temporarily relied on phones.
In late August, Governing Mayor Kai Wegner confirmed Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin did not pay, and the group published the stolen material on September 4. Reports put the total at about 1.4 million files, though Chief Digital Officer Florian Hauer was reported as describing roughly 1.3 million after a second batch.
The published material reportedly includes personnel records, scanned identity cards, payslips, job references and contracts, as well as building-project information. The Senate has said the material is mostly unstructured data from employee shared and personal folders, rather than specialist applications, and expects citizens’ and companies’ data may also be affected. In an October investigation, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; Bonde’s department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap highlights a practical weakness in security spending: a detection system can be installed yet miss activity on devices it does not monitor. In this incident, rbb24 reported that the attackers’ entry computer and the servers involved in the data transfer were outside the system’s licensed coverage. That does not establish that broader coverage would certainly have stopped the theft, but it raises questions about whether the deployment could detect this attack in time.
The consequences extend beyond government operations. Leaked identity and employment information can expose people to impersonation, targeted scams or misuse, while documents about public buildings and infrastructure may create additional security concerns. The Senate said the stolen files carried no more than the lowest of its four classification levels; that classification does not, by itself, show that individual records are harmless or establish what damage has occurred.
For residents and staff, the leak creates a continuing risk even after the network intrusion ends. Berlin’s advice, as summarized in the source reporting, is to verify messages claiming to come from authorities, change passwords, use two-factor login, monitor bank statements and report suspected misuse to police.
Popular right now
De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
Ninja NC501 CREAMi XL Deluxe 11-in-1 Ice Cream and Frozen Treat Maker with Two XL Containers
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
The Senate’s account says the main data transfer occurred from August 7 to 12, with no further attack on the state network after August 13. The breach was detected the next day. A Tagesspiegel commentary reported that the departments were told by the state IT service provider, ITDZ, that they had been hit. Berlin later isolated the departments while it responded.
The detection-system details emerged in rbb24’s October reporting. The urban development department told the broadcaster that the system introduced in 2026 had licenses for only 5% of its devices; expanding coverage was not possible “for financial reasons,” according to the source’s translation. The department also said the entry computer and the servers from which the data left were not covered.
There is a broader budget backdrop, but the causal link is unproven. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available reporting does not establish that those cuts caused the later five-percent deployment. The departments had also told rbb in 2024 that funding for IT security was available only partly to the required extent.
Questions About Exposure and Cause
The full contents of the published files and the number of people whose information was exposed have not been established in the source material. The Senate expects citizens’ and companies’ data to be affected, but the reporting does not provide a verified count or a complete account of the records. It is also unclear whether the leaked information has been used for fraud or other harm.
The available reporting does not establish that the reported budget reductions caused the limited software coverage, or that full coverage would have prevented the breach. It also does not give a complete account of the detection system’s performance across all Berlin agencies. The figure of about 1.4 million files is widely reported, while Hauer was reported as citing roughly 1.3 million after a second batch; the source material does not reconcile the counts.
Monitoring the Leak’s Aftermath
Berlin’s immediate task is to continue assessing which records were exposed and to notify affected people and organizations as that information becomes available. The source material does not specify a deadline for completing that work or describe a final public accounting of the breach. Residents and employees should follow official guidance and treat unexpected messages that use personal details with care.
The detection issue also leaves questions for Berlin’s government and its IT provider: which devices are now covered, whether the uncovered systems have been added, and how the departments will fund and test monitoring across their networks. The source reporting does not identify a published timetable for wider deployment or a formal review of the security-budget decisions. Further Senate statements, investigation findings or audits may clarify both the scale of exposure and the response to the coverage gap.
Key Questions
What happened in the Rhysida attack on Berlin?
Rhysida stole files from two Berlin Senate departments in August 2026. After Berlin refused a reported demand for 30 bitcoin, the group published the material on September 4.
What does the reported 5% detection coverage mean?
Rbb24 reported that the urban development department had licenses for its detection system on 5% of its devices. The department said the computer identified as the entry point and the servers involved in the data transfer were outside that coverage.
What kinds of information were exposed?
Reporting describes personnel files, identity-card scans, payslips, contracts and building-project information among the material. The Senate expects citizens’ and companies’ data may also be affected, but the complete contents and number of affected people are not known from the available reporting.
Did Berlin’s budget cuts cause the security gap?
That has not been established. Berlin’s 2025 budget included reported reductions to intrusion detection and the IT service center, but the available reporting does not show that those cuts caused the later five-percent coverage.
What should people do if they may be affected?
Follow official notices, verify messages that claim to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police, according to the advice described in the source reporting.
Source: ThorstenMeyerAI.com
