🔍 Read the full analysis: Berlin’s Administration Under Attack: Rhysida, AI, And Detection on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Rhysida stole data from two Berlin Senate departments in August 2026 and published about 1.4 million files after the city refused to pay a 30-bitcoin ransom. A public broadcaster later reported that an attack-detection system at the urban development department covered just 5% of devices, excluding the computer identified as the entry point and the servers from which data was taken.
Rhysida stole and later published about 1.4 million files taken from two Berlin Senate departments, while a detection system at one department covered just 5% of its devices, according to reporting by rbb24. The August 2026 breach exposed sensitive personnel and government material; the report said the system did not cover the computer identified as the attackers’ entry point or the servers from which data was copied.
Berlin detected the intrusion on August 14, after most of the data had already left the network. The Senate says the main outflow took place between August 7 and 12, and that the state network was not attacked again after August 13. The affected offices were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment.
The Senate disconnected both departments from the state network as a precaution. Services were disrupted, and staff temporarily worked by phone, rbb24 reported. Berlin later said the attackers demanded 30 bitcoin, valued at about €2 million. The city refused to pay; Rhysida published the files on September 4 after the deadline passed. Berlin’s Chief Digital Officer, Florian Hauer, has cited a figure of roughly 1.3 million files, while several reports put the total at about 1.4 million.
Reporting by rbb24 and other outlets described the leak as containing scanned identity documents, personnel files, payslips and contracts, as well as records concerning building projects and critical infrastructure. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature. Bonde’s department confirmed she was affected. The Senate said the material was predominantly unstructured data from employees’ shared and personal directories, rather than data from specialist applications.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection
The reported coverage gap matters because detection tools can only alert on activity they can observe. According to rbb24, the device identified as the entry point and the servers used to transfer data were outside the system’s licensed coverage. The breach illustrates a practical limitation: deploying a security product does not provide organization-wide monitoring if most devices remain outside its reach.
The leak also creates risks beyond the initial disruption. Files containing personal information can expose affected employees and others to targeted scams or identity misuse. The Senate expects that data relating to citizens and companies may also be involved, though the precise number and identities of affected people have not been established in the source material. The incident’s scale and the exposure of a senior official’s identity documents make it a public-sector security and privacy issue, not only an IT outage.
For residents and staff, the immediate concern is that leaked details may make fraudulent messages appear credible. The source advises verifying messages claiming to come from authorities, changing reused or exposed passwords, enabling two-factor authentication, monitoring bank statements and reporting suspected misuse to police.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Intrusion to Public Leak
The incident unfolded over several weeks. Berlin says data was taken mainly from August 7 to 12; officials detected the attack on August 14 and made it public three days later. In late August, Governing Mayor Kai Wegner confirmed the administration was being extorted. After Berlin declined to pay the ransom, Rhysida published the stolen files on September 4.
The detection system was introduced in 2026, but the urban development department told rbb that licenses covered only 5% of its devices. It said expanding coverage to all devices was not possible “for financial reasons,” as translated in the source. The city’s 2025 budget had cut €2 million from intrusion detection, while the IT service center’s budget line fell from €32.2 million to €18.2 million, according to netzpolitik.org. However, the available reporting does not establish that those budget reductions caused the specific coverage limit.
Berlin’s information-security guideline has required authorities since 2017 to provide adequate resources for protection, according to the source. An internal 2023 security report had also called for expanding systems to detect and defend against cyberattacks. Those earlier plans provide context for the reported 2026 coverage, but do not by themselves establish why implementation remained limited.
What the Breach Has Not Settled
The public account does not establish the full number of affected people or the complete contents of the leaked archive. The Senate expects citizens’ and companies’ data may be included, but the available source material does not give a confirmed count or identify every affected record. Reports differ slightly on the archive’s size: Hauer referred to roughly 1.3 million files, while other outlets reported about 1.4 million.
It is also not clear from the cited material how the attackers first gained access, whether the entire archive has been reviewed, or what further investigative findings have been released. The relationship between Berlin’s 2025 budget reductions and the 5% licensing coverage is unproven. The department cited financial constraints, but that alone does not establish which budget decisions led to the specific deployment.
Investigation and Support for Affected People
The next steps are to establish what information was exposed, notify people whose records were affected and continue the technical investigation. The source material does not provide a timetable for completing those tasks or for expanding detection coverage across Berlin’s systems. Updates from the Senate and the affected departments will be needed to clarify the scope of exposure and any changes to security monitoring.
People who may be affected should treat unexpected messages referring to personal or official details with caution and verify them through independently confirmed contact channels. They can change exposed or reused passwords, enable two-factor authentication, monitor financial accounts and report suspected identity misuse to police, in line with the advice cited in the source.
Key Questions
What happened in the Berlin cyberattack?
Rhysida stole files from Berlin’s Senate departments for urban development and transport in August 2026. The city detected the attack on August 14; the group published the files on September 4 after Berlin refused to pay a ransom.
What does the 5% detection figure refer to?
Rbb24 reported that the detection system introduced at the urban development department had licenses for 5% of its devices. The report said neither the identified entry-point computer nor the servers from which data was taken were covered.
What information was exposed?
Reports describe personnel records, scanned identity documents, payslips, contracts and other material. Rbb24 also reported finding Transport Senator Ute Bonde’s identity card and stored digital signature in the leak. The full scope and number of affected people remain unclear.
Did Berlin pay the ransom?
No. The Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused, and the group published the files on September 4.
What should potentially affected people do?
Be wary of messages that use personal details, verify claims through official contact channels, change exposed or reused passwords, enable two-factor authentication and monitor bank statements. Report suspected misuse to police.
Source: ThorstenMeyerAI.com
