🔍 Read the full analysis: The Cost Of Watching Just 5% Of Devices In Berlin on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A public broadcaster reported that Berlin’s attack-detection software covered licenses for only 5% of devices in the urban development department when Rhysida stole files from two Senate departments in August 2026. The department said broader coverage was not possible for financial reasons; the entry computer and servers used to transfer data were outside the covered group. The relationship between that licensing limit and earlier budget cuts has not been established.
A cyberattack detection system in Berlin’s Senate Department for Urban Development, Building and Housing had licenses for just 5% of devices when ransomware group Rhysida stole files from two city departments in August, according to an rbb24 investigation. The department said extending coverage was not possible “for financial reasons”; the computer identified as the attackers’ entry point and the servers used to transfer data were not covered.
Berlin’s Senate says most of the data was taken between August 7 and 12. The attack was noticed on August 14, and the two departments were disconnected from the state network as a precaution, according to rbb24. The Senate made the incident public three days later. Berlin’s Senate Chancellery said Rhysida demanded 30 bitcoin, then worth about €2 million. The city refused to pay, and the group published stolen files online on September 4.
Reports put the leak at about 1.4 million files, although Berlin Chief Digital Officer Florian Hauer described the number as roughly 1.3 million after a second batch. Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity cards, payslips, job references, contracts and material related to building projects. Tagesspiegel also reported that files included birth certificates of employees’ children and rehabilitation records. The Senate said the material was predominantly unstructured data from employees’ shared and personal directories.
In an investigation published October 21, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The Senate has said citizens’ and companies’ data may also be involved. The reported licensing limit concerns the urban development department; the available source material does not establish that the same percentage applied to every affected department or device across Berlin’s administration.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Coverage Gaps Left Key Systems Outside Detection
The reported gap matters because the security system was not monitoring the computer and servers associated with the attack. According to rbb24, the software had been introduced in 2026, but licenses covered only one device in 20 in the urban development department. That figure describes the share of devices with licenses, not a measured estimate of how much of the attack could otherwise have been prevented.
The theft exposed personal and government information, and the leak’s contents could create risks beyond the immediate disruption. People whose records were stolen may face targeted scam messages that use real personal details. Information about public works and infrastructure could also be sensitive, although the Senate said the stolen files carried no higher than the lowest of its four classification levels, as reported by the source material.
The case also makes a concrete question of public accountability: whether authorities funded and deployed the monitoring they had planned. A licensing limit alone does not prove that wider coverage would have stopped Rhysida or prevented the data loss. It does show that the systems tied to the reported entry and transfer of data were outside the tool’s coverage.
Popular right now
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
Sony BRAVIA 5 85-Inch Mini LED 4K HDR Smart TV (K-85XR50)
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
As an affiliate, we earn on qualifying purchases.
Earlier Security Plans and Budget Cuts
Berlin’s information security guideline has required authorities since 2017 to provide sufficient staff and funding for protection, according to the source report. An internal security report from 2023, seen by rbb, had proposed expanding systems to detect and defend against cyberattacks so incidents could be identified earlier. In 2024, the two departments told rbb that funding for IT security had been available only “partly to the required extent.”
Berlin’s 2025 budget reduced €2 million from intrusion detection and cut the IT service center’s budget line from €32.2 million to €18.2 million, according to netzpolitik.org in November 2024. Those figures provide budget context, but the available reporting does not establish that the cuts caused the later five-percent licensing coverage. The attack itself happened in August 2026, before the files were posted in September.
“Funding for IT security had been available only “partly to the required extent.””
— Berlin departments, as quoted by rbb
The Budget Link Remains Unproven
Public reporting has not established whether the 2025 budget reductions caused the five-percent licensing limit, or who made the final decision on the level of coverage. The source material also does not give a complete inventory of which devices were licensed, how the percentage was calculated, or whether other monitoring tools covered systems outside the detection software.
The total number of exposed files remains inconsistent in public accounts: reports commonly cite about 1.4 million, while Hauer referred to roughly 1.3 million after a second batch. The full contents of the leak and the number of people or organizations affected have not been confirmed. Berlin has said that citizens’ and companies’ data may be included, but the scale is not specified.
It is also not known whether wider deployment would have detected the intrusion in time to prevent the theft. The attack’s reported dwell period and missing coverage raise questions about detection, but they do not prove that broader licensing alone would have stopped the attackers.
Investigation and Public Guidance
Berlin’s authorities will need to clarify the extent of the exposure, identify affected people and organizations, and explain how security monitoring will be expanded or otherwise strengthened. The available source material does not provide a schedule for those steps or report a completed public review of the licensing decision.
People who may have had records exposed should be alert to messages that appear to come from government offices and verify them through official contact channels. The guidance cited in the source material also recommends changing passwords, using two-factor login, monitoring bank statements and reporting suspected misuse to police. Those are precautions; the reporting does not confirm that every person whose information appears in the leak has experienced fraud.
Key Questions
What did rbb24 report about Berlin’s detection system?
rbb24 reported that licenses for the attack-detection system covered 5% of devices in the urban development department. The computer identified as the entry point and the servers used to transfer data were not covered.
What information was published online?
Reporting identified personnel records, scanned identity cards, payslips, job references, contracts and project information. The Senate says the files were mainly unstructured material from employee directories; the full contents and number of affected people remain unclear.
Did Berlin pay Rhysida’s ransom demand?
No. Berlin refused the group’s demand for 30 bitcoin, which the Senate Chancellery said was worth about €2 million at the time. Rhysida published files on September 4, after the deadline passed.
Did budget cuts cause the limited device coverage?
That has not been established. Berlin’s 2025 budget reduced funding for intrusion detection and the IT service center, but the available reporting does not prove that those cuts caused the five-percent licensing coverage in 2026.
What should people who may be affected do?
Verify messages claiming to come from authorities through official channels, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police, according to the guidance cited in the source material.
Source: ThorstenMeyerAI.com
