How Berlin’s Administration Faced Rhysida With Limited Detection

🔍 Read the full analysis: How Berlin’s Administration Faced Rhysida With Limited Detection on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Berlin’s urban development department had cyberattack detection licenses for just 5% of its devices when Rhysida stole data from it and the city’s transport department in August 2026, according to an rbb24 investigation. The department told the broadcaster that expanding coverage was not possible “for financial reasons”; the reported entry computer and the servers from which data left were not covered.

The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. According to the Berlin Senate and rbb24, most of the data was copied between August 7 and 12. Authorities detected the intrusion on August 14 and disconnected both departments from the state network as a precaution. The Senate made the incident public three days later.

In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said the attackers demanded 30 bitcoin, then valued at about €2 million. Berlin refused to pay, and Rhysida published the stolen files on September 4. Reporting by rbb24 and Tagesspiegel put the leak at about 1.4 million files; Berlin Chief Digital Officer Florian Hauer described the total as roughly 1.3 million after a second batch.

The files reportedly included personnel records, scanned identity cards, payslips, job references and contracts, as well as building-project information. The Senate said the material was predominantly unstructured data from employees’ shared and personal directories, rather than specialist applications, and said information belonging to citizens and companies may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.

A Coverage Gap in Berlin’s Defenses

The finding is significant because the reported shortfall was not simply a matter of whether Berlin had purchased detection software. The system did not cover the devices involved in the reported intrusion, limiting its ability to raise an alert from those systems. The attack’s main data transfer took place over several days before it was detected, according to the Senate’s timeline.

For people whose information was exposed, the leak creates a risk of targeted fraud or impersonation. rbb24 and Tagesspiegel reported that the files included sensitive personal documents, and the Senate said the data of citizens and businesses may also be involved. Berlin’s advice, as relayed in the source reporting, is to treat messages claiming to come from authorities cautiously, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.

The case also raises questions about public-sector security spending and oversight. A reported budget reduction may be relevant background, but the available reporting does not establish that it caused the five-percent license coverage. The episode shows why the scope of a security tool, and which systems it actually covers, matters as much as its presence in an agency’s inventory.

Products Worth Considering

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite

AmazonView Latest Price

Bose SoundLink Max Bluetooth Speaker

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From Intrusion to Public Leak

Berlin’s Senate information page says the state network was not attacked again after August 13, while the data theft had largely taken place before the intrusion was detected on August 14. The two departments were disconnected from the network and temporarily relied on phone-based work, with some public services limited, rbb24 reported. The state IT provider, ITDZ, reportedly informed the departments that they had been hit.

The leak’s scale and contents emerged over time. After Berlin declined the ransom demand, Rhysida posted files online on September 4. In October, rbb24 reported that the material included Bonde’s identity document and stored digital signature, as well as emails belonging to her predecessors. The Senate said the stolen information carried at most the lowest of its four classification levels, according to Hauer’s remarks to the Interior Committee; that classification does not mean the files contained no sensitive personal information.

There was also a broader funding debate before the attack. Netzpolitik.org reported in November 2024 that Berlin’s 2025 budget reduced a line for intrusion detection by €2 million and cut the IT service center’s budget from €32.2 million to €18.2 million. The urban development and transport departments had told rbb in 2024 that funds for IT security were available only partly to the extent required. Reporting has not shown that these budget changes directly produced the later license limit.

Questions About Scope and Cost

The full number of people and organizations whose information was exposed remains unclear. The Senate expects that data belonging to citizens and companies may be included, but the source reporting does not provide a final count or a complete inventory of affected records. Public accounts also differ on the total file count: most cited reports say about 1.4 million, while Hauer gave a figure of roughly 1.3 million after a second batch.

It is also not clear from the available material how the attackers first gained access, what specific weakness enabled the intrusion, or whether any other detection controls raised alerts. The reported five-percent coverage applies to the urban development department; the source does not establish the precise coverage rate in the second department. Nor does it establish that the 2025 budget cuts caused the limited licensing, or whether Berlin has since expanded detection coverage.

Public Review and Security Measures

The immediate next steps are for Berlin to clarify the affected population, continue notifying people and organizations whose records may have appeared in the leak, and report on any confirmed misuse. Residents and employees should follow official guidance, check the authenticity of messages purporting to come from government offices, secure accounts with new passwords and two-factor authentication, and report suspected identity or financial fraud.

Berlin’s authorities also face questions about the review of the incident and the reach of their security monitoring. The source material does not specify a public deadline for a full technical report or describe a confirmed plan to license the detection system across all devices. Any later account should distinguish what was present at the time of the attack from measures introduced afterward, and explain whether the reported entry point and data-transfer servers are now monitored.

Key Questions

Which Berlin departments were affected?

The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment.

When did Berlin detect the attack?

The Senate and rbb24 reported that Berlin detected the intrusion on August 14, 2026. Most of the data transfer had taken place between August 7 and 12, according to the Senate’s timeline.

What does the 5% figure mean?

The urban development department told rbb that licenses for its attack-detection system covered 5% of its devices. The reported entry computer and the servers from which data left were outside that coverage.

What information appeared in the leak?

Reports described personnel files, scanned IDs, payslips, contracts and building-project information. The Senate said the data was mainly from employee directories and said information belonging to citizens and companies may also be affected.

Did Berlin pay the ransom?

No. Berlin refused Rhysida’s reported demand for 30 bitcoin. The group published the stolen files on September 4, 2026.

Source: ThorstenMeyerAI.com