🔍 Read the full analysis: The 5% Detection Question Behind Rhysida’s Berlin Attack on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin detected a Rhysida intrusion on August 14, 2026, after attackers had copied data from two Senate departments. An rbb24 investigation published in October found that one department’s detection system covered licenses for only 5% of its devices, excluding the reported entry computer and the servers involved in the data transfer. The account does not establish that budget cuts caused the limited coverage.
Berlin’s Rhysida ransomware attack exposed a major gap in detection coverage: the Senate Department for Urban Development, Building and Housing told broadcaster rbb that a system introduced in 2026 had licenses for only 5% of its devices. The department said it could not extend coverage “for financial reasons”; rbb reported that the computer identified as the attackers’ entry point and the servers from which data was taken were not covered.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. According to the Berlin Senate’s incident information, most of the data was copied between August 7 and 12. The intrusion was noticed on August 14, and the Senate made it public three days later. The departments were disconnected from the state network as a precaution, disrupting some services, rbb24 reported.
Berlin said the attackers demanded 30 bitcoin, described at the time as worth about €2 million. The city refused to pay. Rhysida published the stolen files on September 4. News reports put the leak at about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer cited roughly 1.3 million after a second batch, according to the source material.
Reporting by rbb24 and Tagesspiegel describes personnel records, scanned identity cards, payslips, job references, contracts and documents about construction projects and critical infrastructure among the material. The Senate characterized the files as mainly unstructured information from employees’ shared and personal directories, rather than data taken from specialist applications, and said information about citizens and companies may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
What Limited Coverage Left Exposed
The 5% figure matters because detection tools can only alert staff to activity they can observe. In this incident, rbb reported that neither the identified entry computer nor the servers involved in the data leaving the network had coverage. The department’s statement does not, by itself, establish exactly how broader coverage would have changed the attack or prevented the theft. It does show that the system’s licensed reach did not include key devices identified in the incident account.
For people whose records were exposed, the leak creates risks beyond the immediate disruption of government systems. Personal details can be used to make messages appear credible or to support attempts at identity misuse. Berlin’s guidance, as summarized in the source reporting, advises residents to check messages claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police.
The case also raises a practical public-sector question: what protection does an organization actually have when security software is deployed on only a small share of its devices? The answer depends on which systems are covered, how alerts are reviewed, and what other safeguards are in place. The available reporting identifies a coverage gap but does not provide a full technical account of the attack or all defenses Berlin had deployed.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
As an affiliate, we earn on qualifying purchases.
Berlin’s Security and Budget Record
The departments told rbb in 2024 that funding needed for IT security was available only “partly to the required extent,” according to the source material. Berlin’s information security guideline, in place since 2017, calls on authorities to provide adequate staff and funding for protection. An internal 2023 information security report seen by rbb had already proposed expanding systems to detect and defend against cyberattacks earlier.
Berlin’s 2025 budget reduced €2 million from intrusion-detection funding and lowered the IT service center’s budget line from €32.2 million to €18.2 million, netzpolitik.org reported in November 2024. Those figures establish budget changes, not their direct effect on the later licensing decision. The source material does not establish that the cuts caused the five-percent coverage, and the department’s explanation for limited deployment was financial constraints rather than a specific budget line.
The attack timeline also helps explain the stakes. The Senate says most data left the network over several days before the incident was detected. Berlin’s public account says the state network was not attacked again after August 13. That sequence indicates a period of unauthorized access and data transfer, but the public information cited here does not detail precisely when the attackers entered, how they moved between systems or what alerts were generated.
What the Public Record Still Lacks
The reporting does not establish whether funding reductions caused the five-percent coverage, or whether other budget, procurement or technical decisions shaped the deployment. Nor does it quantify how many of the department’s devices were exposed to the attackers or what additional detection and response measures were operating beyond the system discussed by rbb.
The exact number of files and the full population of people and organizations whose information was exposed also remain unsettled in the cited accounts. The reported totals vary, and the Senate has said citizens’ and companies’ data may be included. Public descriptions identify sensitive examples, but do not provide a complete inventory of the leak or confirm that every file was accessed by third parties after publication.
More technical details remain unavailable in the source material, including the complete entry and movement path, the precise contents of the stolen data, and the extent of any subsequent misuse. The fact that files appeared online confirms publication, not that every affected person has been identified or notified.
Further Disclosure and Public Guidance
The next developments to watch are any updated findings from Berlin’s investigation, clearer figures on affected people and organizations, and information about steps taken to expand or otherwise improve detection coverage. The available source material does not give a date for a final incident report or a commitment to cover all devices.
For people who may be affected, the practical advice in the reporting remains to treat unexpected messages purporting to come from government offices with caution, change reused or exposed passwords, turn on two-factor login, review financial statements and contact police about suspected identity or financial misuse. Residents should rely on official Berlin channels for confirmed notices about the breach and any further guidance.
For the government, the unresolved issue is whether the public will receive a detailed account of the intrusion and a clear explanation of how detection coverage will change. Until then, the confirmed record is narrower: data was stolen and published, the attack was detected after the main period of data transfer, and a detection system in one affected department covered licenses for only 5% of devices.
Key Questions
What happened in the Rhysida attack on Berlin?
Attackers accessed Berlin’s Senate departments for urban development and for mobility and transport, then copied data. The Senate says most of the data transfer occurred from August 7 to 12, 2026; the intrusion was detected on August 14. Rhysida published files on September 4 after Berlin refused its ransom demand.
What does the 5% detection figure mean?
The urban development department told rbb that its attack-detection system, introduced in 2026, had licenses covering 5% of its devices. The department said broader coverage was not possible for financial reasons. The reported entry computer and servers involved in the data transfer were not among the covered devices.
What information was exposed?
Reports describe personnel records, scanned identity cards, payslips, job references, contracts and documents related to construction projects and critical infrastructure. The Senate said the material was mainly unstructured data from employee directories. The complete inventory and full list of affected people are not publicly clear in the cited accounts.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget reduced intrusion-detection funding by €2 million, and the IT service center’s budget line also fell. The reporting identifies those cuts but does not show that they directly caused the 5% licensing level.
What should people do if they may be affected?
Follow official Berlin guidance: verify messages claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. Do not assume that a message is genuine just because it contains personal details.
Source: ThorstenMeyerAI.com
