🔍 Read the full analysis: How Rhysida’s Entry Into Berlin Connects To Device Monitoring on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused its ransom demand. An rbb24 investigation found that an attack-detection system introduced that year was licensed for only 5% of devices in the urban development department; the computer and servers involved in the attack were outside that coverage.
Rhysida stole data from two Berlin Senate departments in August and published about 1.4 million files after the city refused a ransom demand, while an rbb24 investigation found the departments’ new attack-detection system covered only 5% of devices in the urban development department. The computer identified as the entry point and the servers from which data was taken were not covered, leaving key parts of the network outside the system’s monitoring.
Berlin’s Senate says most of the data left its network between August 7 and 12, 2026. The attack was detected on August 14, and the two affected departments were disconnected from the state network as a precaution. The Senate made the incident public three days later. The affected agencies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused to pay, and the group published the files on September 4. Accounts differ slightly on the total: Chief Digital Officer Florian Hauer referred to roughly 1.3 million files after a second batch, while most reporting cited about 1.4 million.
Reports by rbb24 and Tagesspiegel describe personnel records, scanned identity cards, payslips, job references, contracts and building-project information among the stolen material. The Senate said the files were mainly unstructured data from employees’ shared and personal directories, rather than specialist applications. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Device Monitoring
The case connects a specific data breach to a concrete gap in device-monitoring coverage. According to the department’s response to rbb, licenses for the detection system covered only 5% of devices, and the systems identified as the attack’s entry point and data-exit servers were outside that group. A monitoring tool cannot alert on activity from devices it does not cover, though the available reporting does not establish that broader coverage alone would have stopped the theft.
For residents and employees, the exposure is not limited to public embarrassment or service disruption. Identity documents and personnel information can be used in targeted fraud or convincing impersonation attempts. The Senate has said citizen and company data may also be affected, while the full scope of individual exposure has not been publicly established. People whose information may be involved should treat unexpected messages claiming to come from public agencies with caution, verify them through official channels, and watch for suspicious account or banking activity.
For public agencies and other organizations, the reported gap raises practical questions about whether detection systems cover the devices and servers that hold or move sensitive information. Coverage is only one part of security: logging, access controls, network separation and a response plan also shape how quickly an intrusion can be found and contained. The Berlin incident makes those operational details relevant to the public because the stolen files included both personal records and information about public projects.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
The sequence reported by Berlin officials and news outlets began with data leaving the state network during August 7–12. Officials say the network was not attacked again after August 13. The breach was noticed on August 14, after most of the reported data outflow had already occurred. The departments were taken off the network for safety and, for a time, relied on telephone operations; rbb24 reported that some citizen services were limited.
Berlin’s refusal to pay did not prevent the publication of the stolen material. Rhysida posted the files after the ransom deadline, and later reporting identified sensitive records in the leak. The Senate said the material carried no higher than the lowest of its four classification levels, but classification does not determine whether information such as identity documents or employee records can be misused.
The funding backdrop is documented, but its relationship to the device-coverage gap is not. In 2024, the two departments told rbb that funding for IT security had been available only partly to the required extent. Netzpolitik.org reported that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. Those figures do not establish that the budget cuts caused the five-percent licensing level reported for the later system.
What the Coverage Finding Cannot Establish
The reporting establishes that the system covered 5% of devices in the urban development department and that the identified entry computer and data-exit servers were outside its coverage. It does not establish that a fully licensed system would have detected the intrusion in time, prevented data theft, or changed the outcome. The exact route into the network and the attackers’ full sequence of actions have not been detailed in the source material.
The total number of affected people and organizations also remains unclear. The Senate expects citizen and company data to be among the files, but the complete contents and extent of exposure have not been publicly confirmed. Published totals vary between roughly 1.3 million and 1.4 million files. Nor is it established that the 2025 budget reductions caused the later licensing shortfall; the reported figures show financial pressure, not a proven direct link.
Further Disclosure and Exposure Checks
Berlin’s next task is to determine which people and organizations are identifiable in the published files and communicate any confirmed exposure. The source material does not specify a deadline for a complete assessment or describe a final forensic account of the intrusion. Until those details are available, the full impact should be treated as developing rather than settled.
People who may be affected can follow official notices, verify messages through independently obtained government contact details, change passwords that may have been exposed or reused, and use two-factor login where available. The source reporting also advises monitoring bank statements and reporting suspected misuse to police. For agencies, the unresolved operational question is whether monitoring now covers the computers and servers that handle sensitive data, alongside stronger logging and containment measures.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says data was taken from two Senate departments in August 2026. Rhysida demanded 30 bitcoin; after the city refused to pay, the group published the files on September 4.
What does the 5% device figure mean?
According to the urban development department’s response to rbb, licenses for its attack-detection system covered 5% of devices. The computer identified as the entry point and the servers from which data left were not covered.
What information was reportedly exposed?
Reports describe personnel records, scanned ID cards, payslips, references, contracts and building-project information. The Senate says the material mainly came from employee file directories; the complete scope of affected people and organizations is not yet clear.
Did Berlin’s budget cuts cause the monitoring gap?
That has not been established. Reporting documents earlier reductions to intrusion-detection and IT-service budgets, but does not prove that those cuts caused the later five-percent licensing level.
What should someone do if they may be affected?
Follow official notices, verify unexpected messages claiming to come from authorities, change potentially exposed or reused passwords, turn on two-factor login where available, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
