🔍 Read the full analysis: Could AI Have Changed The Cost Of Rhysida’s Attack On Berlin? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Rhysida stole data from two Berlin government departments in August 2026 and published about 1.4 million files after the city refused to pay a ransom. An rbb24 investigation found that a newly introduced detection system covered only 5% of devices in one department, including neither the computer identified as the entry point nor the servers from which data was taken. The reporting does not establish that earlier budget cuts caused the coverage gap or that broader coverage would have prevented the theft.
Rhysida stole data from two Berlin government departments in August 2026 and later published about 1.4 million files after the city refused to pay a ransom, according to Berlin officials and media reports. An investigation by public broadcaster rbb24 found that a cyberattack detection system introduced that year covered only 5% of devices in the urban development department—and did not cover the computer identified as the attackers’ entry point or the servers from which data was taken.
Berlin’s administration detected the intrusion on August 14. The Senate says most of the data left the network between August 7 and 12, and that the state network was not attacked again after August 13. The affected departments were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a precaution, temporarily disrupting some services, rbb24 reported.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin did not pay, and the group published the files on September 4, after its deadline passed. Reports put the total at about 1.4 million files; Chief Digital Officer Florian Hauer described a figure of roughly 1.3 million after a second batch, according to the source reporting.
Material identified in the leak includes personnel records, scanned identity documents, payslips and contracts, as well as information about building projects and critical infrastructure. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; her department confirmed she was affected. The Senate said the files were predominantly unstructured data from employee directories, rather than data from specialist applications, and expects that citizens’ and companies’ information may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection
The reported coverage gap matters because detection tools can only alert staff to activity on systems they monitor. In this incident, rbb24 reported that neither the computer identified as the entry point nor the servers from which data left were covered by the system’s licenses. The Senate’s timeline places the main data transfer over several days before officials detected the attack, illustrating the potential consequences of limited visibility—without proving that broader monitoring would have stopped this breach.
The theft has direct implications for people whose personal documents were exposed. Copies of identification and employment records can be used to make fraudulent messages seem credible or to support identity misuse. The source advises people to verify messages claiming to come from authorities, change passwords, use two-factor login, monitor bank statements and report suspected misuse to police. The exposed digital signature also raises concerns about how attackers might try to exploit personal information; the material provided does not establish that it has been misused.
For public agencies, the case puts a concrete question behind cybersecurity spending: whether protections cover the devices and servers that hold sensitive information, not just a small portion of a network. That is a reported shortfall in this department, not evidence that a particular budget decision alone caused the breach.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The city’s account places the main data outflow between August 7 and 12, 2026, with detection on August 14 and a public announcement three days later. The departments were isolated from the state network while the incident was handled. Rhysida’s demand and Berlin’s refusal followed; the files appeared online on September 4. rbb24’s October investigation then highlighted both the sensitive contents and the limited device coverage of the detection system.
The urban development department told rbb24 that licenses for the system introduced in 2026 covered 5% of its devices, and that expanding coverage was not possible “for financial reasons,” according to the source’s translation. Separately, reporting by netzpolitik.org in November 2024 said Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available reporting does not establish that these cuts caused the later five-percent coverage level.
Berlin had also identified the need to expand systems for detecting and defending against cyberattacks in an internal information-security report from 2023, according to rbb24. The city’s information security guideline, in place since 2017, calls on authorities to provide adequate staff and funding for protection. These earlier details provide budget and policy context, but do not by themselves show what specific measures would have prevented the 2026 attack.
What the Coverage Gap Proves
The reports establish that the detection system covered only 5% of devices in the urban development department and that the identified entry computer and data-transfer servers were outside that coverage. They do not establish that extending the system would have detected the intrusion sooner, blocked the attackers or prevented the data from being copied.
It is also not clear from the supplied reporting exactly how many people or organizations are affected, what proportion of the published files have been examined, or whether exposed information has been used for fraud. The reported file totals differ: most coverage cites about 1.4 million, while Hauer reportedly gave a figure of roughly 1.3 million after a second batch. The relationship between Berlin’s 2025 budget cuts and the later licensing shortfall has not been established.
Exposure Review and Public Guidance
Berlin’s departments and information-security officials still need to determine which people, companies and government activities are represented in the published files and what support or protective steps affected individuals may need. The material provided does not give a completion date for that work or describe a final accounting of the incident.
People who may be affected should treat unexpected messages that refer to personal or government-related details with caution, verify requests through official contact channels, change reused passwords, enable two-factor authentication and monitor financial accounts. Anyone who suspects identity misuse should report it to police. The central unanswered policy question is whether Berlin will expand detection coverage and what resources it will allocate; the supplied reporting does not specify a decision or timetable.
Key Questions
What happened in the Rhysida attack on Berlin?
Attackers stole data from Berlin’s Senate departments for urban development and for mobility and transport. The city detected the intrusion on August 14, 2026; Rhysida published the files on September 4 after Berlin refused its ransom demand.
What did the detection system cover?
According to rbb24’s investigation, licenses covered 5% of devices in the urban development department. The computer identified as the entry point and the servers from which data was taken were not covered.
What information was exposed?
Reports describe personnel records, scanned IDs, payslips, contracts and information about building projects and critical infrastructure. rbb24 also reported finding Transport Senator Ute Bonde’s ID copy and stored digital signature in the leak; her department confirmed she was affected.
Would full device coverage have prevented the attack?
The available reporting does not establish that. It identifies systems outside the detection tool’s coverage, but does not show whether wider monitoring would have detected or stopped the intrusion.
What should people do if their information may be exposed?
Verify messages that claim to come from authorities, change passwords, enable two-factor login and monitor bank statements. Report suspected misuse to police, following the advice in the source material.
Source: ThorstenMeyerAI.com
