🔍 Read the full analysis: AI And Cybersecurity In Berlin: What Rhysida’s Attack Reveals on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole and later published about 1.4 million files taken from two Berlin Senate departments in August 2026. An rbb24 investigation reported that an attack-detection system introduced that year covered just 5% of devices in the urban development department, and did not cover the identified entry PC or the servers from which data left. The connection between Berlin budget cuts and that limited coverage has not been established.
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused a ransom demand, while an rbb24 investigation found that a detection system in the urban development department covered only 5% of devices. The system did not cover the PC identified as the attackers’ entry point or the servers from which data was taken, raising questions about how Berlin’s security coverage was funded and deployed.
Berlin’s Senate says most of the data left the network between August 7 and 12. The attack was noticed on August 14, and the Senate made it public three days later. The affected departments—the Senate Department for Urban Development, Building and Housing, and the Senate Department for Mobility, Transport, Climate Protection and Environment—were disconnected from the state network as a safety measure. Some work shifted to phone, and several citizen services were limited, rbb24 reported.
In late August, Governing Mayor Kai Wegner confirmed Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, worth about €2 million. Berlin did not pay. On September 4, after the deadline passed, the group published the files. Officials have described the total as roughly 1.3 million after a second batch; most reporting cited in the source material puts it at about 1.4 million files.
The leak includes personnel records, scanned identity cards, payslips, contracts and building-project information, according to reporting by rbb24 and Tagesspiegel. The Senate described the material as mostly unstructured files from employees’ shared and personal directories, rather than data from specialist applications. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; her department confirmed she was affected. The Senate expects that information about citizens and companies may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Berlin’s Detection Coverage Gap
The reported five-percent coverage matters because detection tools can alert defenders only to activity on systems they monitor. According to rbb24, neither the identified entry PC nor the servers from which data was taken were covered by the licenses in the urban development department. That left the systems implicated in the breach outside the tool’s reach, although the available information does not establish that broader coverage alone would have prevented the theft.
The leaked material creates potential risks for people whose identity and employment information was exposed, as well as for public bodies and businesses whose details appear in the files. Personal information can be used to make fraudulent messages more convincing. Berlin’s advice, as reported in the source material, is to check messages that claim to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
The incident also puts a practical public-sector security question in focus: whether detection, logging and network separation cover the systems that hold or move sensitive information. The findings concern one department’s coverage and this particular attack; they do not establish the level of protection across every Berlin agency.
Products Worth Considering
Jackery Solar Generator 1000 v2 with 200W Solar Panel
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Breach to October Findings
The Senate says the state network was not attacked again after August 13, and that the main data outflow occurred in the days before the breach was detected. The two departments had to be disconnected during the response. Tagesspiegel reported that the state IT service provider ITDZ informed the departments they had been hit.
In its October 21 investigation, rbb24 reported that the attack-detection system had been introduced in 2026, but licenses covered just 5% of devices in the urban development department. The department said extending coverage to all devices was not possible “for financial reasons,” in translation from the source. It also said the PC identified as the entry point and the servers involved in the data outflow were not covered.
There is relevant budget history, but it is not proof of a direct cause. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center budget line from €32.2 million to €18.2 million. The available reporting does not establish that those cuts caused the five-percent licensing coverage.
“Extending the system to all devices was not possible “for financial reasons.””
— Berlin’s urban development department, as quoted by rbb24
What the Investigation Has Not Established
The reporting does not establish whether the budget cuts reported for 2025 directly caused the limited device coverage, or whether broader monitoring would have stopped the attackers. The exact number of files is also described differently: officials cited roughly 1.3 million after a second batch, while most outlets cited in the source material report about 1.4 million.
The full set of affected people and organizations remains unclear. The Senate expects citizen and company data to be among the exposed material, but the available account does not provide a complete inventory. Nor does it detail the full technical route into the network or the extent to which each exposed file has been accessed or used since publication.
Assessing Exposure and Security Coverage
Berlin will need to continue identifying affected records, notifying people and organizations where appropriate, and responding to reports of fraud or misuse. The source material does not give a timetable for completing that work or for making a full account of the breach public.
For the security review, the unresolved questions include which devices and servers are now covered by detection tools, whether monitoring and logging have been expanded, and how the city will fund those measures. Further public reporting or statements from the Senate and the affected departments may clarify the scope of the exposure and any changes made after the attack.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says attackers took data from the urban development and mobility and transport Senate departments in August 2026. Rhysida published the files on September 4 after Berlin refused a ransom demand.
How many files were published?
Most reporting cited in the source material puts the number at about 1.4 million files. Berlin’s Chief Digital Officer cited roughly 1.3 million after a second batch, so accounts differ.
What did the rbb24 investigation find about detection?
It reported that licenses for an attack-detection system covered just 5% of devices in the urban development department. The identified entry PC and the servers from which data left were not covered.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Netzpolitik.org reported cuts to Berlin’s 2025 intrusion-detection and IT service center budgets, but the available reporting does not show that those cuts caused the licensing gap.
What should people who may be affected do?
Follow official notices, verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police, according to advice cited in the source material.
Source: ThorstenMeyerAI.com
