🔍 Read the full analysis: AI Security In Practice: Rhysida’s Attack On Berlin’s Administration on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused a ransom demand. An rbb24 investigation reported that an attack-detection system introduced that year covered licenses for only 5% of devices in one affected department, excluding the entry-point PC and the servers used to remove data.
Rhysida stole data from two Berlin government departments in August and later published about 1.4 million files after the city refused a ransom demand, while an rbb24 investigation found the attack-detection system at one affected department had licenses for just 5% of devices. The uncovered devices included the computer identified as the attackers’ entry point and servers from which data was taken, raising questions about whether budget and coverage decisions left the administration unable to spot the intrusion in time.
Berlin’s Senate said the main data outflow took place from August 7 to 12. The city detected the attack on August 14, disconnected both affected departments from the state network as a precaution, and made the incident public three days later. The departments were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. The Senate said the state network was not attacked again after August 13.
In late August, Governing Mayor Kai Wegner confirmed Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, then valued at about €2 million. Berlin did not pay, and the group published the files on September 4, after the deadline passed. Authorities and news organizations have described the haul as roughly 1.3 million to 1.4 million files; about 1.4 million is the figure reported by several outlets.
The material reported in the leak includes personnel records, scanned identity cards, payslips, contracts and job references, as well as documents about construction projects and critical infrastructure. The Senate described the files as mainly unstructured data from employees’ shared and personal directories and said citizens’ and companies’ data may also be affected. In an October investigation, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and her stored digital signature. Her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Detection Coverage
The incident links a large public-sector data breach to an operational gap: according to the department’s account to rbb24, its detection system did not cover most devices, including machines relevant to the intrusion. A security tool’s presence alone does not establish that the systems most likely to reveal an attack are being monitored. The reported gap matters because attackers can remain inside networks while copying data, leaving defenders a limited window to identify and contain the activity.
The potential consequences extend beyond government operations. Leaked identity and employment records can expose people to targeted impersonation or fraud, while documents about public projects and infrastructure may create additional risks. The Senate said some citizen and business data may be included, but the full population of affected people and the precise contents of the leak have not been established publicly. The case also puts attention on whether public agencies have funding and staffing to apply security controls across the systems they need to protect.
For people who may be affected, Berlin’s reported guidance is to treat messages claiming to come from authorities with caution, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These precautions do not confirm that any particular person’s information was published.
Popular right now
Ninja Foodi 8-Quart DualZone 6-in-1 Air Fryer, Grey (DZ201)
De'Longhi Magnifica XS ECAM22110B Automatic Espresso Machine
LG 85-Inch QNED73B Mini LED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
The sequence began with data leaving the two departments between August 7 and 12. The administration detected the incident on August 14 and isolated the departments from the state network. The Senate disclosed the attack on August 17. Some services were limited while the affected offices worked by phone, according to rbb24. In late August, Berlin confirmed the ransom demand; on September 4, Rhysida posted the files after the city declined to pay.
The detection system’s coverage became a central issue after rbb24 reported in October that the urban development department had licenses for only 5% of its devices when the system was introduced in 2026. The department said extending coverage to all devices was not possible “for financial reasons,” according to the source report’s translation. It also said the PC identified as the entry point and the servers from which data flowed were outside the licensed group.
There is relevant budget history, but it does not establish what caused the coverage gap. Reporting by netzpolitik.org in November 2024 said Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available information does not prove that those cuts led directly to the five-percent coverage reported by rbb24.
What the Breach Record Still Lacks
The public record does not establish the full number of people and organizations affected, or whether every file posted by Rhysida was successfully downloaded by outsiders. Reported totals vary: Florian Hauer referred to roughly 1.3 million files after a second batch, while several outlets have reported about 1.4 million. The exact total and the overlap between batches remain unclear.
It is also not established that the 2025 budget reductions caused the system to cover only 5% of devices. The department cited financial reasons for limited licensing, but the available reporting does not document the budget decision-making behind that specific limit. Details about the full route attackers used, the complete duration of their access and whether additional systems or data were affected have not been publicly resolved in the source material.
Further Audit and Victim Guidance
Berlin’s immediate task is to determine which records were taken, identify people and organizations at risk, and support affected departments as they restore secure operations. The reported findings also make the scope of detection coverage a key issue for any follow-up review: whether licenses and monitoring now include the devices and servers involved, and what resources agencies need to close gaps.
Readers who may be affected should follow official notices from Berlin, be alert for messages that use personal details to appear credible, update reused or exposed passwords, enable two-factor authentication, monitor financial accounts and report suspected identity misuse to police. The source material does not give a date for a final public accounting of the breach or specify when Berlin will complete a review of its detection coverage.
Key Questions
Which Berlin departments were affected?
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment.
What did Rhysida take and publish?
Reports describe about 1.3 million to 1.4 million files, including personnel records, scanned identity cards, payslips, contracts and documents about public projects. The Senate said the material was mainly unstructured files from staff directories and that citizen and business data may also be involved.
Why did the attack-detection system miss the intrusion?
According to the urban development department’s account to rbb24, licenses covered only 5% of its devices, and extending coverage was not possible “for financial reasons.” The reported entry-point computer and the servers from which data was taken were not covered. The complete technical explanation has not been made public in the source material.
Did Berlin pay Rhysida?
No. The Senate Chancellery said the group demanded 30 bitcoin, about €2 million, and Berlin refused. Rhysida published the files on September 4, after the deadline passed.
What should people who may be affected do?
Berlin’s reported advice is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. The source material does not confirm that every resident or employee is affected.
Source: ThorstenMeyerAI.com
