🔍 Read the full analysis: How Rhysida’s Berlin Breach Raises Questions About Security Savings on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin’s Senate Department for Urban Development, Building and Housing said licenses for a cyberattack detection system covered only 5% of its devices, and the computer identified as the attackers’ entry point and the servers involved in the data theft were outside that coverage. Rhysida published about 1.4 million files stolen from two Berlin departments after the city refused a ransom demand. Reporting links the breach to a detection gap, but the available information does not establish that earlier budget cuts caused it.
Berlin’s Rhysida breach exposed a major gap in cyberattack detection: the city’s Department for Urban Development, Building and Housing told broadcaster rbb24 that licenses for its detection system covered just 5% of its devices. The computer identified as the attackers’ entry point and the servers used to take data out were not covered, as the ransomware group stole files from two Senate departments and later published them online.
Berlin noticed the intrusion on August 14, 2026, according to the Senate and rbb24. The Senate says most of the data left the network between August 7 and 12. The two affected departments—the urban development department and the Department for Mobility, Transport, Climate Protection and Environment—were disconnected from the state network as a precaution. Some services were limited, and staff temporarily relied on phone-based work, rbb24 reported.
Rhysida demanded 30 bitcoin, worth about €2 million, according to the Senate Chancellery. Berlin refused to pay, and the group published files on September 4. Most reports put the total at about 1.4 million files; Chief Digital Officer Florian Hauer previously described the amount as roughly 1.3 million after a second batch. The material included personnel records, scanned identity documents, payslips, contracts and building-project information, according to rbb24 and Tagesspiegel.
In an investigation published October 21, rbb24 said the leak contained a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature. Bonde’s department confirmed she was affected. The Senate has described the stolen material as mostly unstructured files from employee shared and personal directories, rather than information from specialist applications. It expects that citizens’ and companies’ data may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert defenders about activity on systems they monitor. In this case, rbb24 reported that neither the computer identified as the entry point nor the servers from which data left were included in the licensed coverage. That does not establish precisely how broader coverage would have changed the incident, but it shows that the system could not monitor those devices as configured.
The breach also has direct consequences beyond government operations. Exposed identity and employment records can give criminals information to use in impersonation or targeted scam messages. The publication of a senior official’s identity document and stored signature adds a concrete example of the personal and administrative material involved. Berlin has advised people to check suspicious messages, change passwords, enable two-factor authentication, monitor bank statements and report misuse to police.
For public agencies and other organizations, the case puts a practical question behind cybersecurity spending: whether licenses, staffing and monitoring cover the systems that hold sensitive information and carry data out. A tool’s presence in an organization does not mean every device is protected by it. The evidence presented so far, however, does not show that a particular budget decision caused the breach.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Berlin’s Security Budget Trail
The city had discussed constraints on security spending before the attack. In 2024, both affected departments told rbb that funds required for IT security were available only partly to the extent needed. A 2023 internal information-security report, seen by rbb, proposed expanding systems for detecting and defending against cyberattacks so incidents could be caught earlier. Berlin’s information-security guideline, in place since 2017, requires authorities to provide adequate personnel and funding for protection.
Berlin’s 2025 budget reduced the intrusion-detection allocation by €2 million and lowered the IT service center budget line from €32.2 million to €18.2 million, according to netzpolitik.org. Those figures provide budget context, but the available reporting does not establish whether those cuts led to the later decision to license the detection system for only 5% of devices. The department’s explanation to rbb was that extending coverage was not possible “for financial reasons.”
The sequence of the attack also matters: data was leaving the network for several days before Berlin noticed the intrusion. The Senate says there was no further attack on the state network after August 13. Berlin made the incident public on August 17, and Mayor Kai Wegner confirmed later in August that the city was being blackmailed. The ransom demand and September publication followed.
“Extending the system to all devices was not possible “for financial reasons.””
— Berlin’s Department for Urban Development, Building and Housing, as quoted by rbb24
What the Breach Record Cannot Show
The precise connection between budget decisions and the 5% coverage figure remains unestablished. Berlin’s 2025 budget included cuts to intrusion detection and the IT service center, and the department cited financial reasons for not expanding licenses. But the reporting provided does not show that the budget reductions directly caused that coverage decision, or that restoring a specific amount of funding would have prevented the attack.
The full scope of the exposed information is also still uncertain. The Senate expects data belonging to citizens and companies to be affected, while the published files include a wide range of personnel and administrative records. The total is commonly reported as about 1.4 million files, though Hauer gave a figure of roughly 1.3 million after a second batch. A file count does not establish how many people were affected or how many records contained usable personal information.
The available information does not detail every step the attackers took, the complete systems accessed or the final impact on individuals. It also does not establish whether any exposed data has been used for fraud. The Senate said the files were at most at the lowest of four classification levels; that classification does not mean the records posed no risk to the people named in them.
Follow-Up on Exposure and Protection
The immediate priority for affected people is to treat unexpected messages claiming to come from Berlin authorities with caution. The advice reported by the source material is to verify such messages independently, change passwords, switch on two-factor authentication, monitor bank statements and report suspected misuse to police. People should avoid relying on details in a message as proof that it is genuine, since leaked information can make impersonation more convincing.
For Berlin, the key unresolved public questions are how many devices are now covered, whether the uncovered entry computer and servers have been examined in full, and what further steps the administration will take to protect data across its agencies. The reporting cited here does not provide a timetable for expanding detection coverage or a final accounting of affected people and organizations. Further findings from the city and investigators will be needed to clarify the exposure and how Berlin plans to address the monitoring gap.
Key Questions
What happened in the Rhysida attack on Berlin?
Attackers stole files from Berlin’s departments for urban development and transport-related matters. The Senate says most data left the network between August 7 and 12, 2026; Berlin noticed the attack on August 14. Rhysida published the stolen files on September 4 after the city refused its ransom demand.
What does the 5% detection coverage figure mean?
The urban development department told rbb24 that licenses for its detection system covered 5% of its devices. The computer identified as the entry point and the servers from which data was taken were outside that coverage.
What information was exposed?
Reports describe personnel files, scanned identity documents, payslips, contracts and building-project information among the leaked material. The Senate says the files were mainly unstructured data from employee directories and expects citizens’ and companies’ data may also be affected. The full number of people affected is not established.
Did budget cuts cause the security coverage gap?
That has not been established. Berlin cut funding for intrusion detection and reduced the IT service center budget line in its 2025 budget, while the department cited financial reasons for limiting licenses. The available reporting does not prove that the cuts caused the 5% coverage level.
What should people do if they may be affected?
Berlin’s reported advice is to verify messages claiming to come from authorities, change passwords, enable two-factor authentication, watch bank statements and report suspected misuse to police. People should be cautious with messages that use personal details to appear credible.
Source: ThorstenMeyerAI.com
