🔍 Read the full analysis: AI Security Lessons From Rhysida’s Entry Into Berlin’s Administration on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused its ransom demand. An rbb24 investigation found the attack-detection system in one department covered only 5% of devices; the entry computer and data-transfer servers were outside that coverage. The precise link between earlier budget cuts and the limited licenses has not been established.
Berlin’s administration failed to detect a Rhysida intrusion that copied data from two Senate departments in August, and an October rbb24 investigation found that the attack-detection system in one department covered just 5% of its devices. The computer identified as the attackers’ entry point and the servers from which data was taken were not covered, leaving the city’s monitoring gap directly relevant to a breach that exposed roughly 1.4 million files.
Berlin’s Senate says most of the data was taken between August 7 and 12, 2026. The attack was detected on August 14. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin disconnected both departments from the state network as a safety measure, and some services were limited while staff relied on phones, rbb24 reported.
In late August, Governing Mayor Kai Wegner confirmed the city was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, worth about two million euros at the time. Berlin declined to pay. The group published files on September 4, after the ransom deadline. Officials and news reports have described the volume as roughly 1.3 million to 1.4 million files; about 1.4 million is the figure most outlets have reported.
The reported material includes personnel records, scanned identity documents, payslips and contracts, as well as information about building projects and critical infrastructure. The Senate has described the files as mostly unstructured material from shared and personal employee directories, rather than data from specialist applications. Rbb24 reported in October that the leak included a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; her department confirmed she was affected. The Senate also expects data belonging to citizens and companies to be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Monitoring Gap With Personal Risks
The case illustrates the practical limits of deploying a security tool without broad device coverage. According to the urban development department’s account to rbb, the system introduced in 2026 had licenses for only 5% of devices. Rbb24 reported that neither the suspected entry computer nor the servers involved in the data leaving the network were included. The source material does not establish that wider coverage would necessarily have prevented the breach, but it does show that these systems were outside the tool’s reach.
For people whose records may be in the leak, the consequences go beyond the publication of files. Stolen identity and employment information can support convincing impersonation or fraud attempts. Berlin’s guidance, as reported in the source material, is to verify messages claiming to come from authorities, change passwords, enable two-factor login, check bank statements and report suspected misuse to police. Readers should treat unexpected requests for personal or financial information cautiously, particularly if a message refers to details that appear private.
For public agencies and other organizations, the episode is a reminder that cybersecurity spending is tied to coverage, staffing and the ability to review activity across a network. Detection products cannot monitor devices for which they have no licenses. The breach also raises questions about how security controls are prioritized when budgets are constrained, while leaving open whether the limited licensing was a deciding factor in the attackers’ ability to operate undetected.
Popular right now
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
Shark Rocket Ultra-Light Corded Stick Vacuum, HV301, Gray/Orange
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
The August Breach and September Leak
The Senate’s public account says the state network was not attacked again after August 13, and that the main outflow had already taken place before the incident was noticed the following day. The Senate made the attack public three days after detection. A Tagesspiegel commentary reported that the departments learned they had been hit through the state IT service provider, ITDZ. The agencies were isolated from the state network during the response, disrupting some work and public services.
Berlin had previously identified the need to expand systems for early detection and defense. An internal information-security report from 2023, seen by rbb, proposed expanding such systems. The source material also says both departments told rbb in 2024 that funds for IT security were available only partly to the extent considered necessary. Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org in November 2024.
Those figures provide budget context, not proof of a direct cause. The available reporting does not establish that the 2025 cuts produced the 5% licensing level or that a particular funding decision led to the breach. The confirmed point is narrower: the urban development department told rbb that expansion to all devices was not possible “for financial reasons,” and the systems identified in the intrusion were outside the existing coverage.
What the Investigation Has Not Established
It is not clear how the attackers first obtained access beyond the reported identification of a computer as the entry point. The source material does not detail the vulnerability or method used, how the attackers moved through the network, or whether other security controls detected activity. It also does not establish whether broader detection coverage would have stopped the intrusion or limited the amount of data taken.
The total number of files is reported as roughly 1.3 million to 1.4 million, and the full set of affected people and organizations has not been specified. The Senate expects citizen and company data to be among the stolen material, but the available account does not give a complete inventory. Nor is there evidence presented that the 2025 budget reductions directly caused the limited licenses: the department cited financial reasons, while the causal link to those particular cuts remains unproven.
Tracing Exposure and Closing Gaps
The immediate work is to identify whose information appeared in the published files, notify affected people and organizations, and respond to reports of identity misuse. Berlin has not provided, in the material supplied for this report, a full accounting of affected records or a timeline for completing that work. People who may be affected should follow official advice and contact authorities through independently verified channels.
The reporting also leaves a public-sector security question for Berlin: whether the detection system’s coverage will be expanded and how the city will address devices and servers that were outside monitoring. Further findings about the incident, the scope of exposure and any changes to security funding or network monitoring have not been specified. Any assessment of the budget’s role should wait for evidence connecting spending decisions to the licensing gap and the breach.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says Rhysida stole data from two Senate departments in August 2026. After the city refused a demand for 30 bitcoin, the group published the files on September 4.
What did the leaked files contain?
Reports describe about 1.4 million files, including personnel records, scanned ID documents, payslips, contracts and information about building projects. The full list of affected people and organizations is not yet available in the source material.
What does the 5% figure mean?
Rbb24 reported that the detection system in Berlin’s urban development department had licenses covering 5% of devices. The suspected entry computer and the servers from which data was taken were outside that coverage.
Did Berlin’s budget cuts cause the breach?
That has not been established. Berlin’s 2025 budget included cuts affecting intrusion detection and the IT service center, but the available reporting does not prove those cuts caused the department’s limited licensing or the attack.
What should people do if their data may be exposed?
Berlin’s reported advice is to verify messages claiming to be from authorities, change passwords, enable two-factor login, check bank statements and report suspected misuse to police. Use contact details obtained independently rather than relying on links or numbers in unexpected messages.
Source: ThorstenMeyerAI.com
