🔍 Read the full analysis: What AI Security Teams Can Learn From Rhysida’s Berlin Breach on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin’s government says Rhysida stole data from two Senate departments in August 2026 and published about 1.4 million files after the city refused to pay a ransom. An rbb24 investigation found the attack-detection system at one department covered licenses for only 5% of its devices; the computer identified as the entry point and the servers used to move data were outside that coverage. The reason for the limited coverage is reported as financial, but the available material does not establish that earlier budget cuts caused it.
Rhysida stole data from two Berlin Senate departments in August and published about 1.4 million files after the city refused its ransom demand, according to Berlin authorities and local reporting. An rbb24 investigation reported that the attack-detection system at the urban development department had licenses for just 5% of its devices—and did not cover the computer identified as the attackers’ entry point or the servers from which data was taken.
Berlin’s Senate says most of the data left its network between August 7 and 12, 2026. The attack was noticed on August 14. The state network was not attacked again after August 13, according to the Senate’s information page. The two affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment.
After the city declined to pay 30 bitcoin, described by the Senate Chancellery as worth about two million euros, Rhysida posted the files online on September 4. Berlin Chief Digital Officer Florian Hauer gave a figure of roughly 1.3 million files after a second batch; several reports, including rbb24 and Tagesspiegel, put the total at about 1.4 million.
Reporting on the leak identified personnel records, scanned identity documents, payslips, job references, contracts and information about building projects. Tagesspiegel also reported birth certificates belonging to employees’ children and rehabilitation records. The Senate says the material consists predominantly of unstructured data in staff shared and personal directories, rather than data from specialist applications, and expects citizens’ and companies’ information to be affected as well.
In its October 21 investigation, rbb24 reported finding a copy of transport senator Ute Bonde’s ID card and a stored copy of her digital signature in the leak. Her department confirmed that she was affected. The report also identified emails belonging to her predecessors, Manja Schreiner and Bettina Jarasch.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
A Detection Gap at the Breach Point
The reported licensing gap matters because detection tools can only alert defenders to activity on systems they cover. According to rbb24, neither the computer identified as the attackers’ entry point nor the servers from which files were transferred were included in the five-percent coverage. That left the systems central to the intrusion outside the stated scope of the tool.
The incident also shows how a cyberattack can create consequences beyond service disruption. The exposed material includes personal and employment records, and the Senate says data belonging to residents and businesses may also be involved. Published documents can be copied and reused, so people named in them may face impersonation attempts or targeted scams. The extent of any subsequent misuse has not been established in the source material.
For other public bodies and organizations, the reported facts point to practical questions: which devices are monitored, whether logs can reveal data movement, and how quickly teams can isolate affected systems. These are lessons drawn from the reported coverage gap, not proof that broader software coverage alone would have prevented the breach.
Popular right now
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
De'Longhi Dinamica Plus Fully Automatic Espresso Machine
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
From August Intrusion to September Leak
Berlin noticed the intrusion on August 14 and disconnected both departments from the state network as a safety measure. rbb24 reported that staff temporarily worked by phone and that some public services were limited. The Senate made the incident public three days later. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed.
The ransom demand was reported as 30 bitcoin. After Berlin refused to pay, Rhysida published the files on September 4, following the deadline. The Senate says the stolen material was mainly drawn from employee directories. Hauer told the Interior Committee that the files carried, at most, the lowest of four classification levels; that classification does not indicate that personal information in them was harmless.
The detection system had been introduced in 2026, according to rbb24. The department told the broadcaster that licenses covered only 5% of devices and that expansion to all devices was not possible “for financial reasons” (translated from the department’s statement). Separately, netzpolitik.org reported that Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and cut the IT service center budget line from €32.2 million to €18.2 million. The available reporting does not establish that those budget changes caused the specific licensing shortfall.
What the Investigation Has Not Established
The reported five-percent coverage applies to the urban development department’s system; the source material does not provide a comparable licensing figure for the mobility department. It also does not explain how many devices the percentage represents, what other monitoring or security controls were operating, or whether additional detection systems captured any attacker activity.
Berlin has not, in the material provided, published a final accounting of how many individuals and organizations were affected or confirmed whether leaked information has been used for fraud. The reports identify sensitive records, but do not establish that every file was viewed by the attackers or downloaded by others. The relationship between the 2025 budget reductions and the later licensing limit is also unproven.
Affected People and Berlin’s Response
Berlin’s departments will need to clarify the scope of affected records and tell people and organizations whose information is confirmed to be exposed. The supplied reporting does not specify a deadline for a complete impact assessment or describe a final remediation plan for expanding monitoring coverage.
For people who may be affected, the guidance included in the source material is to verify messages claiming to come from government offices, change passwords, turn on two-factor authentication, monitor bank statements and report suspected misuse to police. Those steps do not confirm that any particular recipient’s data has been abused; they are precautions while the full impact remains uncertain.
Further reporting and official updates should establish whether Berlin has expanded detection coverage, what controls have changed since the intrusion, and how many people need direct notification. Until those details are available, the confirmed picture is a major data theft followed by a public leak, alongside a reported monitoring gap at one affected department.
Key Questions
What happened in the Berlin Rhysida breach?
Berlin says attackers stole data from two Senate departments in August 2026. Rhysida published about 1.4 million files on September 4 after Berlin refused a reported demand for 30 bitcoin.
What did the rbb24 investigation find about detection coverage?
rbb24 reported that the urban development department’s attack-detection system had licenses for 5% of its devices. The computer identified as the entry point and the servers used to transfer data were not covered, according to the report.
What kinds of information appeared in the leaked files?
Reports identified personnel records, identity documents, payslips, contracts and project information. Tagesspiegel also reported birth certificates of employees’ children and rehabilitation records. Berlin expects that citizens’ and companies’ data may be affected.
Did Berlin’s budget cuts cause the detection gap?
That has not been established. Berlin’s 2025 budget included reported reductions to intrusion-detection funding and the IT service center budget, but the available reporting does not prove that those cuts caused the five-percent licensing coverage.
What should people who may be affected do?
The advice in the source material is to verify messages claiming to come from authorities, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police. Berlin has not provided a complete public count of affected people in the material supplied.
Source: ThorstenMeyerAI.com
