🔍 Read the full analysis: Rhysida And Berlin’s Administration: Rethinking Device Detection on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster reported that Berlin’s attack-detection software covered licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing during the Rhysida breach. The uncovered entry computer and data-storage servers were involved in the attack, which led to the publication of about 1.4 million files. The reasons for the limited coverage and any direct link to earlier budget cuts have not been established.
Berlin’s Senate says most of the data left the network between August 7 and 12, and that the attack was detected on August 14. The affected offices were the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment. The state disconnected both from its network as a precaution, disrupting some services, according to rbb24.
Berlin made the incident public three days after detection. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused to pay, and the group published stolen files on September 4. Officials and news reports have described the leak as containing about 1.3 million to 1.4 million files.
Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity documents, payslips, contracts and building-project information among the leaked material. The Senate has said the files were mainly unstructured data from employees’ shared and personal folders, rather than specialist applications. In an October investigation, rbb24 reported that the leak included a copy of Transport Senator Ute Bonde’s ID card and stored digital signature. Her department confirmed she was affected.
The urban development department told rbb that expanding detection-system licenses to all its devices had not been possible “for financial reasons,” according to the source’s translation. The broadcaster reported that neither the suspected entry computer nor the servers from which the data flowed were covered by the licenses.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Device Coverage
The reported coverage gap matters because a detection system can only alert staff to activity on devices it monitors. In this case, the broadcaster says the computer used to enter the network and the servers involved in the data transfer were outside the system’s licensed coverage. That does not establish that broader coverage would have prevented the theft, but it raises a direct question about what protection the deployment could provide.
The breach also has consequences beyond the two departments’ operations. Leaked identity and employment records can expose affected people to impersonation and targeted scams. The reported presence of building and infrastructure information has prompted concern about sensitive government material, although the Senate said the stolen files carried no higher than the lowest of four classification levels.
For Berlin, the episode puts technology procurement and security planning under scrutiny. A system’s purchase or rollout is not the same as monitoring the devices where sensitive information is stored or accessed. The reporting does not establish whether the license shortfall resulted from a particular budget decision, or whether wider coverage would have changed the outcome.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
The sequence reported by Berlin’s Senate and local media began with data leaving the network between August 7 and 12. Authorities detected the incident on August 14 and isolated the affected departments. The Senate said the network was not attacked again after August 13. The public learned of the incident on August 17.
After Berlin declined to pay the ransom, Rhysida posted the files online on September 4. The scope became clearer through subsequent reporting. On October 21, rbb24 reported finding Bonde’s identity card and stored digital signature in the material, as well as emails belonging to her predecessors. The same investigation reported the detection system’s five-percent device coverage.
There was a broader budget backdrop, but the causal link is not established. In 2024, Berlin’s budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org. The source material does not show that these reductions caused the limited licenses reported in the department.
What the Investigation Has Not Established
The available reporting does not establish whether a detection system covering every device would have identified the intrusion in time to stop the theft. It also does not explain the full technical sequence: how attackers entered the network, how they moved between systems, or whether other monitoring or security controls generated alerts.
Nor is it clear whether the earlier reductions to Berlin’s intrusion-detection and IT service budgets caused the five-percent coverage described by rbb. The source material gives no confirmed accounting trail connecting those cuts to the specific licensing decision. The precise number of files and the full number of people or organizations affected also remain unsettled; published estimates range from roughly 1.3 million to 1.4 million files, and the Senate expects citizens and companies may be among those affected.
Berlin’s Response and Affected People
The Senate’s public information and the departments’ response will determine how much more can be established about the affected data, the incident’s technical causes and the protection measures now in place. The source material does not provide a date for a final investigation report or a confirmed schedule for expanding detection coverage.
People who may be affected should follow official notices and verify messages claiming to come from government offices. The guidance cited in the source material advises changing passwords, enabling two-factor login, monitoring bank statements and reporting suspected misuse to police. These are precautions, not confirmation that a particular person’s information was exposed or misused.
For Berlin, the next public questions are whether the relevant devices are now covered by monitoring, what additional safeguards have been adopted, and how the city plans to fund them. Those answers would help show whether the reported coverage gap has been addressed; the available account does not yet confirm the outcome.
Key Questions
What happened in the Rhysida attack on Berlin’s administration?
Berlin says attackers stole data from two Senate departments in August 2026. Rhysida demanded 30 bitcoin, and after the city refused to pay, the group published files online on September 4.
What did rbb24 report about device detection?
In an investigation published October 21, rbb24 reported that licenses for the attack-detection system covered 5% of devices in the urban development department. It said the suspected entry computer and the servers from which data was taken were not covered.
What information was exposed?
Reports identified personnel records, scanned IDs, payslips, contracts and building-project information. The Senate described the data as mainly unstructured files from staff directories and said it expects citizens’ and companies’ information may also be affected.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin cut funding for intrusion detection and reduced the IT service center’s budget line in its 2025 budget, but the available reporting does not demonstrate that those decisions caused the five-percent license coverage.
What should people who may be affected do?
Follow official notices, verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These steps do not confirm that a specific person’s data was included in the leak.
Source: ThorstenMeyerAI.com
