🔍 Read the full analysis: How Rhysida Got Into Berlin’s Administration—and What Detection Cost on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused its ransom demand. An rbb24 investigation found that an attack-detection system at the urban development department covered only 5% of devices; the entry computer and data-exfiltration servers were outside that coverage.
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused a ransom demand, while an rbb24 investigation found that the attack-detection system at one affected department covered only 5% of its devices. The computer identified as the attackers’ entry point and the servers from which data was taken were not covered, raising questions about the practical protection provided by the system.
According to the Berlin Senate and rbb24, most of the data left the network between August 7 and 12. The attack was detected on August 14. The affected agencies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a precaution, disrupting some work and citizen services, rbb24 reported. Berlin made the incident public three days later.
The Senate Chancellery said Rhysida demanded 30 bitcoin, worth about €2 million, and Berlin did not pay. The group published the stolen files on September 4, after its deadline passed. Reports put the total at about 1.4 million files; Berlin Chief Digital Officer Florian Hauer described roughly 1.3 million after a second batch. The material reported by rbb24 and Tagesspiegel includes personnel records, scanned identity documents, payslips, contracts and building plans. The Senate said the files were mainly unstructured material from employees’ shared and personal directories.
In its investigation published October 21, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The stolen material also included emails belonging to her predecessors, according to rbb24. The Senate expects that records concerning citizens and companies may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Coverage Missed the Breach Systems
The reported licensing gap matters because the devices involved in the attack were outside the detection system’s coverage. A monitoring product can only help identify suspicious activity on systems it actually watches; the department’s explanation indicates that the installation did not cover either the reported entry computer or the servers used to take data out.
The consequences extend beyond government operations. The leaked files reportedly contain personal and employment information, as well as details about public projects and infrastructure. Such information can be used to make deceptive messages appear credible. Berlin’s advice, as reported in the source material, is to verify messages claiming to come from authorities, change passwords, use two-factor login, monitor bank statements and report suspected misuse to police.
The incident also puts a concrete figure on a broader public-sector security issue: whether agencies have the funding and staffing to apply security measures across their systems. The reporting establishes limited coverage and a department’s financial explanation, but it does not establish that a particular budget decision caused the gap.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Dyson V8 Cyclone Cordless Vacuum
Hisense 85 U7 Mini-LED ULED 4K UHD Smart Google TV (85U7SG, 2026)
As an affiliate, we earn on qualifying purchases.
Budget and Security Plans Before the Attack
Berlin’s information-security guideline has required authorities since 2017 to provide adequate personnel and funding for protection, according to the source material. A 2023 internal information-security report, reviewed by rbb, planned to expand systems for detecting and defending against cyberattacks, with the stated aim of finding attacks earlier.
In November 2024, netzpolitik.org reported that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The urban development department later told rbb that extending the detection system to all devices was not possible “for financial reasons.” The available reporting does not show that the 2025 cuts directly produced the five-percent coverage level, or how much the detection system itself cost.
The Senate has said the stolen data was predominantly unstructured material from employee directories, rather than information taken from specialist applications. Hauer told the Interior Committee that the files were at most at the lowest of four classification levels. That description concerns the classification assigned to the material; it does not mean the leaked personal records carry no risk to the people named in them.
Open Questions on Scope and Cost
The full scope of affected people and organizations remains unclear. The Senate expects that citizens’ and companies’ data may be included, but the source material does not provide a final count or a complete inventory of the records. Reported file totals also vary: most coverage puts the number at about 1.4 million, while Hauer cited roughly 1.3 million after a second batch.
It is also not clear from the available reporting how the attackers first gained access, exactly which vulnerabilities or credentials they used, or how they moved through the network. The source identifies a computer as the entry point and servers as the systems from which data flowed, but offers no technical account of the intrusion. Nor does it establish a direct causal link between Berlin’s 2025 budget reductions and the five-percent licensing coverage.
Investigation and Exposure Response
The next public-facing questions are how Berlin will identify people whose information was published, notify them, and respond to any misuse. The source material does not give a timetable for a final assessment of the stolen data or specify whether the detection system’s coverage has since been expanded. Berlin’s agencies will also face scrutiny over how monitoring, logging and security resources are allocated across the state network.
People who may be affected can follow official notices, independently verify messages that claim to come from government agencies, change reused passwords, enable two-factor authentication and monitor financial accounts. Anyone who suspects identity or financial misuse should contact the relevant authorities, in line with the guidance cited in the source material.
Key Questions
What happened to Berlin’s administration?
Rhysida stole data from two Senate departments in August 2026. Berlin detected the incident on August 14, and the group published files online on September 4 after the city refused its ransom demand.
What did the detection system cover?
According to rbb24, licenses at the urban development department covered 5% of its devices. The computer identified as the point of entry and the servers from which data was taken were not included.
What information was published?
Reports describe about 1.4 million files, including personnel records, scanned identity documents, payslips, contracts and building-related information. The Senate said the material was mainly unstructured data from employees’ directories. The complete list of affected records is not yet public.
Did Berlin pay Rhysida?
No. The Senate Chancellery said the group demanded 30 bitcoin, about €2 million. Berlin refused to pay, and Rhysida published the files on September 4.
Did Berlin’s budget cuts cause the detection gap?
That has not been established. Berlin’s 2025 budget reduced funding for intrusion detection, and the department cited financial reasons for limited coverage. The available reporting does not prove that those budget changes caused the five-percent coverage level.
Source: ThorstenMeyerAI.com
