🔍 Read the full analysis: The Savings And Security Costs Behind Berlin’s Rhysida Incident on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused a ransom demand. An rbb investigation found that an attack-detection system at the urban development department covered only 5% of devices for financial reasons; neither the reported entry computer nor the servers involved were covered. The available reporting does not establish that earlier budget cuts caused the limited coverage.
Berlin’s Rhysida ransomware attack exposed data from two Senate departments, and an rbb investigation has found that an attack-detection system at the urban development department covered just 5% of its devices. The department said expanding the licenses was not possible “for financial reasons”; the computer identified as the attackers’ entry point and the servers from which data was taken were outside that coverage.
Berlin detected the intrusion on August 14, 2026, after data had been copied mainly between August 7 and 12, according to the Senate’s incident information and reporting by rbb. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin disconnected both departments from the state network as a precaution, disrupting some services, rbb24 reported. The Senate made the incident public three days after detection.
Rhysida demanded 30 bitcoin, then valued at about €2 million, according to the Senate Chancellery. Berlin refused to pay, and the group published the stolen files on September 4. The Senate’s Chief Digital Officer Florian Hauer described the total as roughly 1.3 million files after a second batch; other reports cited by the source put the count at about 1.4 million.
Reporting by rbb24 and Tagesspiegel described personnel records, scanned identity documents, payslips, contracts and building-project material among the exposed files. The Senate said the material was mainly unstructured data from employees’ shared and personal folders, rather than specialist applications, and said citizen and company data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The investigation highlights a gap between having security software and placing it where it can observe an attack. At the affected urban development department, the reported system covered one in twenty devices, and neither the identified entry computer nor the servers used to transfer data were covered. That meant the tool could not monitor the specific devices implicated in the reported intrusion.
The consequences reached beyond government network security. The published material reportedly included personal records and identity documents, creating risks of identity misuse and targeted scams for employees and others whose information may have been included. Berlin advised people to verify messages claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank activity and report suspected misuse to police.
The case also gives public agencies and other organizations a concrete budget question: what protection does a security tool provide if licenses do not cover critical endpoints and servers? The available reporting does not establish that broader coverage would certainly have stopped this attack. It does show that the systems named in the account were not covered by the detection system.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Anker SOLIX C300 Portable Power Station, 288Wh
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
From Network Intrusion to Public Leak
According to the Senate’s timeline, the main data transfer occurred from August 7 to 12, and the state network was not attacked again after August 13. Once the intrusion was found, the departments were isolated from the network. The files were published after Berlin rejected Rhysida’s demand, making the incident not only a disruption to government operations but a public exposure of data.
Questions about Berlin’s security funding predated the attack. In November 2024, netzpolitik.org reported that the city’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center’s budget line from €32.2 million to €18.2 million. The urban development department also told rbb that expanding the detection system was not feasible for financial reasons. However, the reported sources do not show that the earlier budget reductions directly caused the system to cover only 5% of devices.
Berlin’s information-security guideline has required authorities since 2017 to provide sufficient staffing and funding for protection, according to the source material. An internal 2023 security report, seen by rbb, had called for expanding systems to detect and defend against attacks earlier. Those prior warnings add context to the coverage gap without, on their own, proving what decisions led to it.
What the Investigation Does Not Establish
The source material does not establish how the attackers first gained access beyond identifying a computer as the reported entry point, or how the detection system’s limited license coverage was decided. It also does not prove that the 2025 budget cuts caused the five-percent coverage level, or that full coverage would have prevented the theft.
The complete number of affected people and organizations remains uncertain. The Senate said citizen and company data may be involved, while the published file count differs between Hauer’s reported estimate of roughly 1.3 million and other outlets’ figure of about 1.4 million. The full contents of the leak and the extent of any subsequent misuse are not established in the supplied reporting.
Follow-Up on Coverage and Exposure
The next questions for Berlin are whether it has expanded detection coverage across the affected departments, what security measures now monitor the systems implicated in the incident, and how it is identifying people whose information was published. The supplied reporting does not give a confirmed timetable for those steps or a final account of the affected population.
People who may be affected should follow official notices and treat unsolicited messages referring to leaked personal details with caution. Berlin’s stated advice, as reported in the source material, is to verify messages said to be from authorities, update passwords, use two-factor login, watch bank statements and report suspected identity misuse to police. Further information from the Senate or investigations by media and authorities may clarify the scope of exposure and the decisions behind the limited software coverage.
Key Questions
What happened in Berlin’s Rhysida incident?
Rhysida stole data from Berlin’s urban development and transport departments in August 2026. After Berlin declined a ransom demand, the group published files online on September 4.
How much of the affected department’s equipment did the detection system cover?
The urban development department told rbb that licenses covered 5% of its devices. The reported entry computer and the servers from which data was taken were not covered.
What information was published?
Reports described personnel files, scanned ID cards, payslips, contracts and building-project information. The Senate said citizen and company data may also be affected; the full scope is not established.
Did Berlin pay Rhysida?
No. The Senate Chancellery said the group demanded 30 bitcoin, about €2 million at the time. Berlin refused, and Rhysida published the files on September 4.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Reporting describes earlier budget reductions and the department’s financial explanation for limited licenses, but does not demonstrate a direct causal link.
Source: ThorstenMeyerAI.com
