🔍 Read the full analysis: Berlin’s Administration, Rhysida, And The Economics Of AI Security on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole files from two Berlin state departments in August 2026 and published about 1.4 million files after the city refused a 30-bitcoin ransom demand. An rbb24 investigation reported that the attack-detection system at one affected department covered licenses for only 5% of devices; the computer identified as the entry point and the servers involved in the data transfer were outside that coverage. The reasons behind the limited coverage and the full impact of the leak remain unclear.
Rhysida stole data from two Berlin state departments in August 2026 and published the files after the city refused a ransom demand, while an rbb24 investigation found that attack-detection software at one affected department covered licenses for only 5% of devices. The computer identified as the attackers’ entry point and the servers from which data left were not covered, raising questions about how Berlin funded and deployed a system intended to detect intrusions.
Berlin’s Senate says most of the data was taken between August 7 and 12, and the attack was detected on August 14. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. They were disconnected from the state network as a precaution, disrupting some work and citizen services, rbb24 reported. The Senate made the incident public three days after detecting it.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin did not pay. On September 4, the group published the stolen material. Reports put the leak at about 1.4 million files; Berlin Chief Digital Officer Florian Hauer has also described the total as roughly 1.3 million after a second batch.
The documents reported in the leak include personnel records, scanned identity cards, payslips, contracts and building-project information. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature; her department confirmed she was affected. The Senate said the material was predominantly unstructured data from employees’ shared and personal directories, rather than specialist applications, and expects citizens’ and companies’ data may also be involved.
The detection-system details came from the urban development department in response to rbb’s questions: licenses covered 5% of its devices, and extending coverage was not possible “for financial reasons,” according to the report’s translation. The entry-point computer and the servers involved in the data transfer were not among the covered devices.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert operators to activity on systems they monitor. In this incident, the reported gap included both the computer identified as the way in and the servers from which data was taken. That does not establish that broader coverage would have prevented the theft, but it limits what the installed system could see.
The breach also involves information that can create risks for people beyond the immediate loss of government data. Identity documents and employment records can support impersonation or targeted scam attempts, while information about public works and infrastructure can be sensitive. The Senate has said citizens’ and businesses’ data may be affected, but has not provided a complete account of whose information was exposed.
For public agencies, the episode makes a budgeting question concrete: whether a security system is funded and deployed across the devices and servers where sensitive information is stored. The 5% figure describes licenses at one department, not necessarily the coverage across all Berlin government systems. The available reporting does not establish that a specific budget cut caused that limited deployment.
Products Worth Considering
HP OfficeJet 250 Wireless Mobile All-in-One Inkjet Printer
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Apple Mac mini Desktop Computer with M4 chip, 10‑core CPU and GPU, 24GB Unified Memory, 512GB SSD, Gigabit Ethernet
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
Berlin’s attack timeline began before the public announcement. The Senate says the main data transfer took place from August 7 to 12; the state network was not attacked again after August 13, and administrators detected the incident on August 14. The two departments were isolated from the network while officials responded. A Tagesspiegel commentary reported that the departments were informed of the attack by the state IT service provider, ITDZ.
After the ransom demand was refused, Rhysida posted files on September 4. Subsequent reporting described a wide range of personal and administrative records, including, according to Tagesspiegel, birth certificates of employees’ children and rehabilitation records. The Senate has said the stolen files carried no higher than the lowest of its four classification levels; that classification does not mean the personal details are harmless.
The funding context predates the attack. In 2024, both affected departments told rbb that money needed for IT security was available only partly to the extent required. Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. Those figures provide budget context, but the reporting supplied does not show that these cuts directly produced the 5% license coverage. An internal 2023 security report, seen by rbb, had already proposed expanding systems to detect and defend against cyberattacks.
Coverage, Cause and Exposure
Several key details remain unsettled. Berlin has not published a complete inventory of affected people, organizations or records, and the Senate expects that citizens’ and companies’ information may be included. The public figures for the leak also differ: Hauer’s reported estimate is roughly 1.3 million files, while other reporting cites about 1.4 million.
The rbb findings concern license coverage in the urban development department. The available source material does not establish the detection coverage in the transport department or across the Berlin administration as a whole. It also does not explain how long the attackers had access before the main data transfer, beyond the reported August timeline.
Finally, the relationship between Berlin’s budget reductions and the limited licenses is unconfirmed. The reported budget changes and the department’s financial explanation are relevant evidence of resource constraints, but they do not by themselves prove that those cuts caused the coverage gap or that broader detection would have stopped this attack.
Berlin’s Response and Resident Precautions
Berlin’s next steps include establishing what information was taken, identifying affected individuals and organizations, and explaining whether detection coverage has changed since the attack. The source material does not provide a public timetable for a full accounting or a complete account of remediation. Further reporting and official notices may clarify the extent of exposure and the status of security upgrades.
People who may be affected should be alert to messages that use personal details or claim to come from a government office. The guidance cited in the source material is to verify such messages through official channels, change passwords, enable two-factor login where available, monitor bank statements and report suspected misuse to police. These precautions do not confirm that a particular person’s records were leaked.
For Berlin’s administration, the immediate test is whether systems that hold sensitive records are now covered by detection and whether agencies can identify suspicious activity quickly. Any assessment of the changes should distinguish planned improvements from verified coverage, and should not treat the breach itself as proof that a particular spending decision caused the incident.
Key Questions
What happened in the Berlin cyberattack?
Berlin says Rhysida accessed the state network and copied data from two Senate departments, mainly between August 7 and 12, 2026. The city detected the attack on August 14. After Berlin refused a ransom demand, the group published files on September 4.
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for an attack-detection system at the Senate Department for Urban Development, Building and Housing, according to rbb24. The reported entry-point computer and the servers from which data left were not covered. The figure does not describe all Berlin government systems.
What information was exposed?
Reports describe personnel records, scanned identity cards, payslips, contracts and building-project material. The Senate said the files were mainly unstructured data from employee directories and expects citizens’ and companies’ data may also be affected. A complete list of records and affected people has not been published.
Did Berlin’s budget cuts cause the detection gap?
That has not been established. Reporting documents reductions in Berlin’s 2025 budget and says the department cited financial reasons for not extending licenses, but the available information does not show that a particular cut directly caused the 5% coverage.
What should people do if they may be affected?
Be cautious with messages that cite personal details or claim to be from an authority. Verify them through official channels, change passwords, enable two-factor login, monitor bank activity and report suspected misuse to police, following the advice cited in the source material.
Source: ThorstenMeyerAI.com
