🔍 Read the full analysis: When Security Savings Meet A Rhysida Attack: Berlin’s Experience on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate departments for urban development and transport were hit by a Rhysida ransomware attack in August 2026, and the group published stolen files after the city refused its ransom demand. A public broadcaster later reported that the detection system in one affected department covered only 5% of devices, leaving the identified entry computer and data-exfiltration servers outside its coverage. The cause of that limited coverage, and the full scope of exposed personal and government data, remain unclear.
Berlin’s Senate departments for urban development and mobility and transport suffered a Rhysida ransomware attack in August, after which the group published about 1.4 million stolen files. An October investigation by public broadcaster rbb24 found that the attack-detection system in the urban development department covered licenses for only 5% of its devices, and did not cover the computer identified as the entry point or the servers from which data was taken.
Berlin’s Senate says the main data theft took place between August 7 and 12. The attack was detected on August 14; both departments were disconnected from the state network as a precaution. The Senate made the incident public three days later. For a period, the departments relied on phone communications and some public services were limited, rbb24 reported.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, worth about €2 million at the time. Berlin refused to pay. On September 4, after the deadline passed, the group published the files. The reported total varies: Chief Digital Officer Florian Hauer spoke of roughly 1.3 million after a second batch, while several reports put the total at about 1.4 million.
Reporting by rbb24 and Tagesspiegel described leaked personnel records, scanned identity cards, payslips, contracts and documents about building projects and critical infrastructure. Tagesspiegel also reported birth certificates of employees’ children and rehabilitation records. The Senate says the files were mainly unstructured data from employees’ shared and personal directories, rather than specialist applications, and expects that citizens’ and companies’ data may also be affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The reported coverage gap matters because detection tools can only alert defenders to activity on systems they monitor. According to rbb24, neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered by the relevant licenses. The department told the broadcaster that extending coverage to all devices was not possible “for financial reasons.”
That detail gives the attack a public-sector budget dimension: the city’s ability to detect intrusions depended in part on how widely security software was deployed. It does not establish that broader coverage would have prevented the attack or stopped the data theft. But the reported mismatch between the systems involved and the devices covered raises questions about how Berlin prioritizes monitoring and whether its current defenses can provide a complete view of its networks.
The consequences are not limited to government operations. Leaked identity and employment records can expose affected people to impersonation and tailored scam messages. Berlin’s advice, as reported in the source material, is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
Products Worth Considering
Jackery Explorer 2000 v2 Portable Power Station, 2042Wh
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The Senate says the state network was not attacked again after August 13, the day before the incident was detected. Both affected departments were then cut off from the network. The sequence means much of the reported data outflow had already happened by the time officials identified the breach, though the precise moment the attackers first gained access has not been provided in the supplied material.
Budget questions predate the incident. In November 2024, netzpolitik.org reported that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The source material does not establish that those cuts caused the 5% coverage reported by rbb24, or that the affected department’s licensing decision followed directly from them.
Berlin’s information-security guideline has required authorities since 2017 to provide sufficient personnel and funding for protection, according to the source material. An internal 2023 security report, reviewed by rbb, had planned to expand systems for detecting and defending against cyberattacks. The available information does not explain how that plan was implemented before the 2026 incident.
Coverage Gaps and Exposure Still Unclear
The 5% figure applies to licensed devices in the urban development department, according to rbb24; the supplied material does not give a comparable coverage figure for the transport department or the wider Berlin administration. It also does not say how many devices were involved, how the covered devices were selected, or whether other monitoring tools operated alongside the system.
The total number and nature of affected records remain imprecise. Reports cite about 1.3 million or 1.4 million files, and the Senate expects citizens’ and companies’ information to be among the material. The full set of exposed individuals and organizations has not been established in the information provided. Berlin’s statement that stolen files had at most the lowest of four classification levels does not, by itself, resolve the risks created by personal documents or operational information.
It is also not established that the 2025 budget reductions caused the limited licensing or that full device coverage would have stopped the intrusion. The source material does not provide a final forensic account of how the attackers entered, how long they had access before data theft began, or whether all affected people have been identified and notified.
Forensics, Notifications and Security Spending
The next points for readers to watch are Berlin’s continuing review of the stolen data, its efforts to identify affected people and organizations, and any further public guidance on protecting accounts and reporting misuse. People who may be affected should follow official instructions and treat unexpected messages using personal details with caution.
Berlin’s departments and IT service provider will also face questions about the attack timeline, the devices and servers involved, and the extent of detection coverage across the administration. Further reporting or official findings may clarify whether the 5% figure reflects a temporary rollout, a longer-term funding choice or another constraint. The available material does not set out a specific publication date for a final technical report or a decision on future security spending.
Key Questions
What happened in the Berlin attack?
Rhysida attackers stole files from Berlin’s Senate departments for urban development and transport in August 2026. After Berlin refused a ransom demand, the group published the files online on September 4.
What does the 5% coverage figure mean?
Rbb24 reported that detection-system licenses covered 5% of devices in the urban development department. The computer identified as the entry point and the servers from which data was taken were outside that coverage.
What information was reportedly exposed?
Reports described personnel files, identity-card scans, payslips, contracts and other documents. The Senate said citizens’ and companies’ data may also be affected, but the full set of exposed people and records has not been established in the available information.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, valued at about €2 million, and Berlin refused to pay. The group published the files after its deadline passed.
Did budget cuts cause the limited detection coverage?
That has not been established. Berlin’s 2025 budget reduced funding for intrusion detection and the IT service center, but the available reporting does not show that those cuts directly caused the department’s 5% licensing coverage.
Source: ThorstenMeyerAI.com
