🔍 Read the full analysis: What Berlin’s Rhysida Breach Says About Monitoring 5% Of Devices on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin officials said Rhysida stole files from two Senate departments in August 2026 and published them after the city refused a ransom demand. An rbb24 investigation found the detection system in the urban development department was licensed for only 5% of devices; the reported entry computer and data-transfer servers were not covered.
Berlin’s 2026 Rhysida breach exposed a gap in the city’s cyber monitoring: an attack-detection system in the Senate Department for Urban Development, Building and Housing had licenses for only 5% of its devices, according to an rbb24 investigation. The department said broader coverage was not possible for financial reasons; rbb24 reported that neither the computer identified as the entry point nor the servers from which data was taken were covered.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate says most of the data left the network between August 7 and 12. The attack was noticed on August 14, and the state made it public three days later. The Senate said there was no further attack on the state network after August 13.
Rhysida demanded 30 bitcoin, described by the Senate Chancellery as worth about two million euros. Berlin declined to pay. On September 4, the group published the files online. Reports put the total at about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer referred to roughly 1.3 million after a second batch. The Senate describes the material as mostly unstructured data from employees’ shared and personal directories, rather than specialist applications.
Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity cards, payslips, contracts and building-project information among the leaked material. The Senate says data belonging to citizens and companies may also be affected. In October, rbb24 reported that the leak included a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; Bonde’s department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
What Limited Coverage Left Exposed
The reported coverage gap matters because a detection tool cannot alert on devices it does not monitor. In this incident, rbb24 says the reported entry computer and the servers involved in the data transfer were outside the licensed portion of the system. That does not, by itself, establish that broader coverage would have prevented the intrusion or stopped the theft. It does show why a deployment percentage alone can obscure whether monitoring reaches the systems most relevant to an attack.
The reported delay between the main data outflow, from August 7 to 12, and discovery on August 14 also points to the value of timely alerts and investigation. Berlin’s departments were disconnected from the state network as a precaution and some public services were limited, according to rbb24. For people whose information may be in the files, the leak creates a risk of targeted impersonation or scams using personal details. The Senate’s warning that citizen and company data may be affected means the consequences may extend beyond government employees.
The budget explanation is part of the story, but the available reporting does not establish that a particular budget decision caused the five-percent coverage. The practical issue for public agencies and other organizations is whether monitoring, logging and response plans cover the devices and servers that handle sensitive information—not just whether a tool has been purchased.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
Berlin noticed the intrusion on August 14, 2026, according to the Senate. The two affected departments were disconnected from the state network for safety, and rbb24 reported that staff temporarily relied on phone services while some citizen services were restricted. By the time the incident became public on August 17, the Senate says most of the data had already left.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The city did not meet Rhysida’s demand, and the group posted the data on September 4 after the deadline passed. The files include material with different degrees of sensitivity. Chief Digital Officer Florian Hauer told the Interior Committee that the stolen files were classified at most at the lowest of four levels, according to the source material; that description does not mean the documents were harmless or free of personal information.
Berlin’s financial constraints predate the attack. A November 2024 report by netzpolitik.org said the 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The source material also says both departments told rbb in 2024 that funds for IT security were available only partly to the required extent. Those figures provide budget context, but no source cited here establishes that the cuts directly produced the system’s 5% license coverage.
Coverage Gaps and Unanswered Questions
The source material does not specify how many devices the 5% represents, how the department selected those devices, or whether other monitoring systems covered any of the uncovered equipment. It also does not establish that full deployment would have detected the intrusion sooner or prevented the data transfer. The department’s stated financial reason is reported, but the exact procurement decision and cost of expanding coverage are not provided.
The full scope of exposed personal and government information remains uncertain. The Senate expects citizen and company data may be involved, while public reporting has identified specific categories and examples; those reports do not establish a complete inventory of the leak. The difference between Berlin’s estimate of roughly 1.3 million files after a second batch and the approximately 1.4 million figure reported by most outlets is also not reconciled in the source material. No evidence here links the 2025 budget reductions directly to the limited licensing.
Public Review and Personal Precautions
Berlin’s account of the breach, the affected systems and the scope of the leaked records remains central to what can be established next. The available source material does not identify a date for a final forensic report or a complete public accounting of affected people and organizations. Further findings from the Senate, its IT service provider, or reporting on the breach could clarify how the attackers entered, why the monitored devices did not include the reported entry point, and what changes are planned.
People who may be affected should be alert to messages that use leaked personal details to impersonate officials or request sensitive information. The advice cited in the source material is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These precautions do not confirm that a particular person’s records were published; the scope of exposure remains under review.
Key Questions
What happened in Berlin’s Rhysida breach?
Berlin says attackers took data from two Senate departments, mostly between August 7 and 12, 2026. After the city refused Rhysida’s demand for 30 bitcoin, the group published files online on September 4.
What does the 5% figure describe?
According to an rbb24 investigation, the cyberattack detection system introduced in 2026 had licenses for 5% of devices in the urban development department. The source material does not give the total device count.
Was the reported entry computer monitored?
No. rbb24 reported that neither the computer identified as the entry point nor the servers from which data later flowed were among the devices covered by the system’s licenses.
What information was exposed?
Reporting identified personnel records, ID scans, payslips, contracts and building-project information. The Senate says citizen and company data may also be affected, but a complete inventory has not been provided.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Reporting describes earlier reductions to Berlin’s IT security and service-center budgets, but the available information does not prove those cuts caused the department’s 5% coverage.
Source: ThorstenMeyerAI.com
