🔍 Read the full analysis: Rhysida’s Berlin Attack: How Device Coverage Affected The Cost on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole and later published about 1.4 million files taken from two Berlin state departments after a data theft in August 2026. Rbb reported that an attack-detection system at the urban development department covered licenses for only 5% of its devices, including neither the reported entry PC nor the servers involved. The department cited financial reasons; available reporting does not establish that earlier budget cuts caused the coverage gap.
A detection system at Berlin’s Senate Department for Urban Development, Building and Housing had licenses for just 5% of its devices when Rhysida stole data from that department and the Senate Department for Mobility, Transport, Climate Protection and Environment in August 2026, according to an investigation by public broadcaster rbb. The department said broader coverage was not possible “for financial reasons”; rbb reported that neither the PC identified as the attackers’ entry point nor the servers from which data was taken were covered.
Berlin detected the attack on August 14, after most of the data had already left the network. The Senate says the main outflow occurred between August 7 and 12, and that the state network was not attacked again after August 13. The two departments were disconnected from the network as a precaution, disrupting some work and citizen services, rbb24 reported. Berlin made the incident public three days after detecting it.
Rhysida demanded 30 bitcoin, described by the Senate Chancellery as worth about €2 million. Berlin refused to pay. On September 4, the group published the stolen material online. Reports put the volume at about 1.4 million files, though Berlin Chief Digital Officer Florian Hauer has also cited a lower estimate of roughly 1.3 million after a second batch.
Rbb24 and Tagesspiegel reported that the leak included personnel records, scanned identity documents, payslips, contracts and building-project information. In October, rbb24 said it found a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature; Bonde’s department confirmed she was affected. The Senate describes the material as mainly unstructured data from employees’ shared and personal directories. It expects that citizens’ and companies’ data may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Coverage Gap With Real Costs
The reported coverage gap matters because detection tools can alert staff only to activity on systems they monitor. Rbb said the reported entry PC and the servers from which data flowed were outside the licensed 5% at the urban development department. That does not establish that wider coverage would have prevented the intrusion, but it identifies a limitation in the department’s ability to observe the systems involved.
The consequences reached beyond government operations. The published files contain sensitive personal and workplace information, and the Senate expects some data belonging to members of the public and businesses may also be affected. People whose details were exposed could face targeted scam messages or identity misuse. The episode also puts the cost of security coverage in practical terms: a decision to limit licenses can leave some devices outside a detection system, while an intrusion may bring response costs, service disruption and lasting risks to those whose information was stolen.
For other public bodies and organizations, the report is a reminder to distinguish having a security product from having it deployed across the systems that matter. Coverage, logging and network separation can affect how quickly an intrusion is identified and contained. The available facts do not show that full coverage would have stopped this attack, or establish how much any narrower deployment changed the final loss.
Products Worth Considering
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
Ring Alarm 5-Piece Wireless Security System
Arlo Pro Wireless Security Camera, 2K HDR, 6th Generation, 4-Camera Kit
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The attack unfolded over several weeks. According to the Senate’s account, most data was copied between August 7 and 12; officials detected the incident on August 14 and isolated the departments. Berlin later confirmed that it was being blackmailed. After the city declined to pay Rhysida’s demand, the group posted the files on September 4.
The October reporting on device licenses added a specific technical and budget dimension to a breach already known for its scale. The urban development department told rbb that the detection system introduced in 2026 had licenses for 5% of all devices, and that extending it was not possible “for financial reasons.” The department’s statement concerns its own device coverage; it does not by itself explain the full security arrangements at both affected departments.
There is also a wider budget backdrop, but a direct link has not been established. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center’s budget line from €32.2 million to €18.2 million. Those figures show earlier budget pressure, but the reporting provided does not demonstrate that the cuts caused the later 5% license coverage.
What the Records Do Not Establish
It is not clear how many people or organizations have been affected, or how much of the published material contains usable personal information. The Senate expects citizen and business data to be included, but the complete scope remains uncertain. Reported file totals also differ: most coverage cites about 1.4 million, while Hauer has referred to roughly 1.3 million after a second batch.
The available reporting does not establish that Berlin’s 2025 budget reductions caused the limited device licenses, nor does it quantify how many files might have been protected by wider coverage. It also does not show that broader deployment would certainly have prevented the theft. The department’s stated financial reason and rbb’s account of uncovered systems are reported findings, not proof of a single cause for the breach.
Response, Support and Security Review
Berlin’s continuing work includes identifying whose information was exposed, notifying affected parties where possible and reviewing the security of systems used by the two departments. The source material does not provide a date for a completed investigation or a full accounting of the stolen data. Further details from the Senate or the departments could clarify the number of affected people, the extent of service disruption and whether device-monitoring coverage has since changed.
People who may be affected should be alert to messages that use personal details from the leak and verify claims made in the name of public authorities through official channels. The source material also advises changing passwords, enabling two-factor login, checking bank statements and reporting suspected misuse to police. These precautions do not confirm that an individual’s data appeared in the files, but can help people respond to suspicious activity.
Key Questions
What happened in the Berlin Rhysida attack?
Rhysida stole files from two Berlin state departments in August 2026, demanded 30 bitcoin and published the material on September 4 after Berlin refused to pay. Reports put the leak at about 1.4 million files.
What did rbb report about device coverage?
Rbb reported that the detection system at the urban development department had licenses for only 5% of devices. The department said wider coverage was not possible “for financial reasons.” Rbb said the reported entry PC and the servers involved were not covered.
What kinds of information were exposed?
Reports described personnel records, scanned ID cards, payslips, contracts and building-project information. Rbb24 reported finding Transport Senator Ute Bonde’s ID card and stored digital signature in the leak. The full scope of affected people and data is not established.
Did earlier budget cuts cause the limited coverage?
That has not been established. Netzpolitik.org reported earlier reductions in Berlin’s intrusion-detection and IT service-center budgets, but the available reporting does not link those cuts directly to the 5% license coverage.
What should people do if they may be affected?
Be cautious with messages that claim to come from authorities, verify them through official channels, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These steps do not establish whether a person’s information was included in the leak.
Source: ThorstenMeyerAI.com
