🔍 Read the full analysis: When Only 5% Of Devices Are Monitored: Rhysida’s Route Into Berlin on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate departments were hit by a Rhysida ransomware attack in August 2026, and the group later published about 1.4 million files after the city refused its 30-bitcoin demand. An rbb24 investigation found that an attack-detection system at the urban development department covered licenses for only 5% of devices; the computer identified as the entry point and the servers involved in the data theft were outside that coverage.
Berlin’s August 2026 ransomware attack exposed data from two Senate departments, and an October investigation by public broadcaster rbb24 found that the detection system at one affected department had licenses for just 5% of its devices. The computer identified as the attackers’ entry point and the servers from which data was taken were not covered, according to the investigation, raising questions about the practical reach of the city’s cyber monitoring.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. The Senate says most of the data theft took place between August 7 and 12; the incident was detected on August 14. Both departments were disconnected from the state network as a safety measure, and some public services were limited while staff worked by phone, rbb24 reported.
Berlin later confirmed that the ransomware group Rhysida demanded 30 bitcoin, which the Senate Chancellery valued at about €2 million. The city refused to pay. On September 4, the group published the stolen material online. Most reports put the number at about 1.4 million files; Berlin Chief Digital Officer Florian Hauer has also cited roughly 1.3 million after a second batch. The Senate describes the material as mainly unstructured data from employee shared and personal directories.
Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity documents, payslips, job references and contracts among the exposed files, along with information about building projects and critical infrastructure. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature. Her department confirmed she was affected, according to the broadcaster. The Senate has said data belonging to citizens and companies may also be included.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Monitoring Gap During the Attack
The reported coverage gap matters because the affected department’s system did not monitor the devices identified as involved in the intrusion and data transfer. According to rbb24, the department said expanding the licenses to every device was not possible “for financial reasons.” That explanation describes the department’s stated constraint; the reporting does not establish that the licensing limit alone caused the theft or that broader coverage would certainly have prevented it.
For people whose details were exposed, the publication creates a continuing risk of identity misuse and targeted scams. The material reportedly includes personal and employment records, while the Senate expects that records involving citizens and businesses may also be affected. The incident also shows why public agencies’ monitoring decisions can have consequences beyond their own networks: leaked documents can expose private information and details about government work.
People who think their information may be involved should be alert to messages that use personal details to appear genuine. The source material reports official advice to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These are precautions, not confirmation that any particular person’s account has been compromised.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
The Senate says the state network was not attacked again after August 13, and the administration noticed the incident the following day. Berlin made the attack public three days later. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed. After Berlin declined to pay the demand, Rhysida posted files on September 4.
The monitoring issue sits alongside earlier concerns about Berlin’s information-security resources. In 2024, the two departments told rbb that funding needed for IT security had been available only partly to the required extent. Separately, netzpolitik.org reported that Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million. Those budget figures are relevant context, but the available reporting does not establish that the cuts caused the 5% licensing limit.
The source material also says Berlin’s information-security guideline, in place since 2017, requires authorities to provide adequate staff and funding for protection. An internal 2023 information-security report reviewed by rbb had proposed expanding systems to detect and defend against attacks earlier. The precise relationship between that proposal, later spending decisions and the 2026 deployment has not been established in the reporting.
What the Reporting Cannot Establish
The reported 5% figure applies to licensed devices in the urban development department; the source material does not give a matching coverage figure for the other affected department. It also does not specify the total number of devices covered by the licenses or provide a complete technical account of how the attackers entered and moved through the network.
It remains unclear whether expanding monitoring would have detected or stopped the intrusion, or whether the city’s 2025 budget changes directly led to the licensing limit. The Senate expects that citizens’ and companies’ data were affected, but the full list of people and organizations represented in the leaked files has not been established. Public reports differ slightly on the file count, with most citing about 1.4 million and Hauer cited as giving roughly 1.3 million after a second batch.
More Clarity on Exposure and Coverage
The next key developments are a fuller account of what data was exposed, who may be affected and what steps Berlin is taking to improve protection. The source material does not identify a deadline for publishing a complete assessment or say whether the detection system’s coverage has since been expanded. Readers should look for updates from the Senate and the affected departments on notifications, security changes and any further analysis of the intrusion.
For people concerned that their details appear in the leak, the immediate steps described in the source are to check that communications claiming to come from public authorities are genuine, update passwords, enable two-factor login, watch financial statements and contact police about suspected misuse. The scale of the potential exposure means that the consequences may continue after the files’ publication, even though the Senate says there was no further attack on the state network after August 13.
Key Questions
What happened in the Berlin Rhysida attack?
Berlin detected a ransomware incident on August 14, 2026, affecting two Senate departments. The Senate says most data was taken between August 7 and 12. Rhysida later published the files after Berlin refused a ransom demand.
How many files were published?
Most reports cite about 1.4 million files. Berlin Chief Digital Officer Florian Hauer has also been reported as giving a figure of roughly 1.3 million after a second batch, so published totals differ slightly.
What does the 5% monitoring figure mean?
According to rbb24, the detection system at the urban development department had licenses for 5% of devices. The broadcaster reported that neither the computer identified as the entry point nor the servers from which data was taken were covered.
Did Berlin’s budget cuts cause the monitoring gap?
That has not been established. Reporting cited earlier reductions to Berlin’s IT security and IT service center budgets, but it does not prove that those cuts caused the department’s 5% licensing limit.
What should people do if they may be affected?
The advice in the source material is to verify messages that claim to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. The complete list of people whose information was exposed remains unknown.
Source: ThorstenMeyerAI.com
