🔍 Read the full analysis: How 5% Device Detection Became Part Of Berlin’s Rhysida Story on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s 2026 attack-detection system had licenses for 5% of devices in the Senate Department for Urban Development, Building and Housing, according to rbb24. The department said wider coverage was not possible for financial reasons; the computer identified as the attackers’ entry point and the servers used to transfer data were not covered. The attack led to the publication of about 1.4 million files, though the scale of harm and the role of budget decisions remain unclear.
Berlin’s attack-detection system covered licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing when the Rhysida ransomware group stole data from two state departments in August, according to an rbb24 investigation published October 21. The department told the broadcaster that wider coverage was not possible “for financial reasons”; neither the computer identified as the attackers’ entry point nor the servers used to transfer data were covered.
Berlin detected the intrusion on August 14, 2026. The Senate’s account says most of the data left the network between August 7 and 12, and the state network was not attacked again after August 13. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a safety measure, limiting some services, rbb24 reported.
Rhysida demanded 30 bitcoin, described by the Senate Chancellery as worth about €2 million. Berlin refused to pay, and the group published files on September 4. Reports put the total at about 1.4 million files, although Chief Digital Officer Florian Hauer gave a lower figure of roughly 1.3 million after a second batch. Reporting on the exposed material includes personnel records, scanned identity documents, payslips, contracts, and information about building projects and critical infrastructure.
The Senate describes the stolen material as mainly unstructured data from employees’ shared and personal directories, rather than information taken from specialist applications. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID and stored digital signature in the leak; her department confirmed she was affected. The Senate has said data belonging to citizens and companies may also be involved.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Detection Coverage Mattered
The reported coverage gap matters because the system was intended to identify cyberattacks, yet the devices rbb24 says were involved in entry and data transfer fell outside its licensed coverage. That does not by itself establish that broader coverage would have prevented the theft or changed its outcome. It does, however, raise questions about what security monitoring could see during the several days when most of the data was reportedly leaving the network.
The incident also shows how the consequences of a public-sector breach reach beyond government operations. Published files reportedly included personal and employment information, and the Senate says citizen and business data could be affected. People whose details appear in stolen files may face impersonation attempts or targeted scam messages. Readers should treat unexpected messages claiming to come from an authority with caution and verify them through a separate, official contact channel.
For public agencies, the issue is not just whether detection software has been purchased, but which devices it covers and whether alerts can be acted on. The 5% figure describes licensing in one department, not necessarily all Berlin government systems. It should not be treated as a complete measure of the city’s cybersecurity or as proof that the same coverage applied across both affected departments.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
The Senate made the incident public on August 17, three days after it was detected. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. After the ransom deadline passed without payment, Rhysida posted the files online on September 4. In October, rbb24’s examination of the leak reported personal material involving Bonde and emails belonging to her predecessors.
The detection system was introduced in 2026, according to the urban development department’s response to rbb24. Berlin’s information-security guideline has required authorities since 2017 to provide sufficient staff and funding for protection. An internal 2023 information-security report reviewed by rbb had planned system expansion to help detect and defend against cyberattacks earlier.
There is also a budget backdrop, but its connection to the coverage gap has not been established. Reporting by netzpolitik.org in November 2024 said Berlin’s 2025 budget reduced intrusion-detection funding by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million. The available information does not show that those reductions caused the 5% licensing level.
What the Leak Figures Do Not Show
The precise number of exposed files remains inconsistent across accounts: Hauer cited roughly 1.3 million after a second batch, while many reports give about 1.4 million. The full contents of the leak, the number of people whose personal information was exposed, and the extent of any misuse are not established in the available reporting. The Senate expects citizen and company data to be affected but has not provided a complete account here.
It is also not clear whether wider monitoring would have detected the intrusion in time to stop the data transfer, or whether the reported budget reductions caused the department to license coverage for only 5% of devices. The source material identifies the uncovered entry computer and transfer servers, but does not provide a full technical account of the attackers’ route, the length of their access, or what other security controls were in place.
Follow-Up on Exposure and Security
Berlin’s departments and state IT provider will need to clarify the scope of affected data, the steps taken to secure systems, and how monitoring coverage will change. Public information should also establish whether the investigation has identified people or organizations whose records were published and whether authorities have confirmed misuse of the data. No specific timetable for those disclosures is stated in the source material.
People who may be affected should watch for unusual messages that use personal details, verify requests through official contact information, review bank activity, and report suspected identity misuse to police. The reporting does not establish that the exposed credentials or signatures have been used fraudulently, so any such warning should be distinguished from confirmed harm.
Key Questions
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for the attack-detection system in Berlin’s Senate Department for Urban Development, Building and Housing, according to rbb24. It is not a reported figure for every Berlin department or the entire state network.
Did the detection system cover the devices involved in the breach?
No. The department told rbb24 that the computer identified as the entry point and the servers from which data was transferred were not among the covered devices.
How many files did Rhysida publish?
Many reports put the total at about 1.4 million files. Chief Digital Officer Florian Hauer cited roughly 1.3 million after a second batch, so the reported totals differ.
Has Berlin confirmed that all exposed data was misused?
No. The source material reports that files were published and that the Senate expects citizen and business data may be affected. It does not establish that all exposed information has been misused or give a complete count of affected people.
Source: ThorstenMeyerAI.com
