🔍 Read the full analysis: What Rhysida’s Berlin Attack Teaches About AI And Cybersecurity on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole files from two Berlin government departments in August 2026 and published about 1.4 million files after the city refused to pay a ransom. An rbb24 investigation found that a newly introduced detection system covered just 5% of devices in one department, excluding the computer and servers involved; the reporting does not establish that budget cuts caused that limited coverage.
Rhysida stole and published about 1.4 million files from two Berlin state departments after a cyberattack in August 2026, while an intrusion-detection system in one department covered just 5% of its devices, according to an rbb24 investigation published in October. The department told rbb that expanding coverage was not possible “for financial reasons”; the computer identified as the attackers’ entry point and the servers from which data left were not covered.
Berlin’s Senate says most of the data was taken between August 7 and 12. The attack was detected on August 14, and the Senate made it public three days later. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. They were disconnected from the state network as a safety measure, temporarily affecting some services, rbb24 reported.
The Senate Chancellery said Rhysida demanded 30 bitcoin, worth about €2 million. Berlin refused to pay. On September 4, after the payment deadline, the group published the stolen material. Authorities and news reports have described the leak as roughly 1.3 million to 1.4 million files. The Senate characterized the material as mainly unstructured data from employees’ shared and personal folders, rather than information from specialist applications.
Reporting on the published files identified personnel records, scanned identity documents, payslips, contracts and building-project information. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature; Bonde’s department confirmed she was affected. The Senate said it expects citizens’ and companies’ data may also be involved. The precise number of people affected has not been established.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Limited Coverage Matters
The reported coverage gap matters because detection tools can only alert defenders to activity on systems they monitor. In this case, rbb24 reported that neither the entry-point computer nor the servers used to transfer data were within the system’s licensed coverage. The intrusion therefore illustrates a practical limitation: installing a security product does not mean an organization can see activity across its network.
The incident also carries direct privacy risks. Leaked identity documents, employment records and other personal details can be used in convincing impersonation attempts or fraud. Berlin’s advice, as described in the source reporting, is to verify messages claiming to come from public authorities, change passwords, use two-factor login, monitor bank statements and report misuse to police.
For public agencies, the case raises questions about how security spending is allocated and how monitoring gaps are identified. It does not, by itself, establish that a particular budget decision caused the breach or that broader coverage would certainly have stopped it. It does show that coverage of the devices involved was absent, according to the investigation.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Sonos Era 100 SL Compact Microphone-Free Speaker – Black
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
Berlin’s Senate says the main period of data exfiltration ran from August 7 through August 12, and that the state network was not attacked again after August 13. Officials discovered the incident on August 14. The administration then isolated the departments from the network while investigating and responding to the breach.
The rbb24 reporting placed the five-percent coverage finding against earlier concerns about funding. In 2024, the departments told the broadcaster that money needed for IT security was available only “partly to the required extent.” Berlin’s 2025 budget reduced a line for intrusion detection by €2 million and cut the IT service center’s budget from €32.2 million to €18.2 million, according to netzpolitik.org. Whether those reductions caused the limited licensing in 2026 is not established.
The source material also says Berlin’s information-security guideline, in effect since 2017, requires authorities to provide sufficient resources for protection. An internal 2023 report, seen by rbb, had called for expanding systems to detect and defend against cyberattacks. Those earlier references provide context for the funding debate, but do not prove a direct link between budget changes and the specific devices left uncovered.
Questions About Scope and Cause
The total number of affected individuals and the full contents of the leak remain unclear. The Senate expects that citizens and companies may be affected, but the available reporting does not give a confirmed count. Accounts also differ slightly on the file total, with figures of roughly 1.3 million and 1.4 million reported.
The public information summarized in the source material does not establish how the attackers first gained access, how they operated inside the network, or whether additional information beyond the published files was taken. The rbb24 investigation says the known entry computer and data-transfer servers were outside the system’s five-percent coverage, but the reporting does not establish that broader monitoring would have prevented the theft.
Nor is a direct causal connection between Berlin’s budget reductions and the limited 2026 licenses confirmed. The department cited financial reasons, while the earlier reductions and funding concerns are separate reported facts. How much they contributed to the licensing decision remains unknown.
Response, Monitoring and Public Advice
Berlin’s authorities will need to continue assessing the exposed files, notifying affected people where appropriate and responding to reports of misuse. The source material does not provide a final accounting of the breach or a date for completion of the investigation. People who may be affected can follow official notices, verify unexpected messages through independently obtained contact details, update passwords and enable two-factor authentication.
For the departments, the next questions are whether coverage has since been expanded, how the uncovered systems will be monitored, and what changes will be made to network security and incident response. The available reporting does not confirm the current licensing level or detail any completed remediation. Further findings from Berlin or investigative reporting may clarify the scale of the exposure and the decisions behind the coverage gap.
Key Questions
What happened in the Rhysida attack on Berlin?
Berlin says attackers stole data from two state departments, mostly between August 7 and 12, 2026. Rhysida published the files on September 4 after Berlin refused its ransom demand.
What did the investigation find about detection coverage?
rbb24 reported that a detection system introduced in 2026 had licenses for just 5% of devices in the urban development department. The identified entry computer and the servers data left from were not covered.
What kinds of information were exposed?
Reports identified personnel records, scanned ID cards, payslips, contracts and building-project information. The Senate said the material was mainly unstructured data from staff folders, and expects citizens’ and companies’ information may also be affected.
Did Berlin’s budget cuts cause the coverage gap?
That has not been established. The department cited financial reasons for not extending coverage, and earlier reports documented reductions to security-related funding, but the available reporting does not show that the cuts caused the 2026 licensing level.
What should people who may be affected do?
Follow official advice: verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
