🔍 Read the full analysis: Could Broader Device Detection Have Changed Berlin’s Rhysida Response? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s urban development department told rbb that its cyberattack detection system, introduced in 2026, had licenses for only 5% of devices. The computer identified as the entry point and the servers from which data was copied were not covered; whether wider coverage would have prevented or limited the theft is unknown.
An rbb24 investigation published October 21 found that a cyberattack detection system at Berlin’s Senate Department for Urban Development, Building and Housing was licensed for just 5% of its devices when the Rhysida ransomware group stole data from two Senate departments in August. The department said extending coverage was not possible “for financial reasons”; the computer identified as the entry point and the servers from which data left were outside the licensed coverage, raising questions about whether broader monitoring could have helped detect the attack sooner.
Berlin’s Senate says most of the data theft took place from August 7 to 12, 2026. The attack was detected on August 14, and the state made it public three days later. The two affected departments—the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment—were disconnected from the state network as a safety measure. Services were limited for a period, rbb24 reported.
Rhysida demanded 30 bitcoin, then valued at about €2 million, according to the Senate Chancellery. Berlin refused to pay, and the group published files on September 4. News reports put the leak at about 1.4 million files; Berlin’s Chief Digital Officer Florian Hauer has also described the total as roughly 1.3 million after a second batch. The files reportedly include personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate says the material is predominantly unstructured data from employees’ shared and personal directories.
In its October report, rbb24 said it found a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Her department confirmed she was affected. The Senate has said it expects data belonging to citizens and companies to be included too. The department’s statement about license coverage applies to the urban development department; the supplied reporting does not establish that the other affected department had the same coverage level.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Coverage Gaps at the Attack’s Entry Points
The reported gap matters because detection tools can only alert on activity within their coverage. In this case, the computer identified as the attackers’ entry point and the servers from which stolen data was transferred were not among the devices covered by the system, according to rbb24’s account of the department’s response. That makes the limited deployment relevant to how Berlin monitored the systems involved.
It does not establish that broader coverage would have stopped the attack. The available information does not show whether a fully deployed system would have detected the intrusion in time, generated an actionable alert, or prevented the files from being copied. Still, the gap raises a practical question for public agencies and other organizations: whether monitoring plans account for the devices and servers that handle sensitive information, rather than only a small share of a network.
The consequences reach beyond government operations. Leaked identity and employment records can expose affected people to impersonation or targeted scam attempts. The Senate has said citizens and companies may also be affected, but the supplied reports do not provide a complete account of who is represented in the files. Anyone contacted by someone claiming to represent an authority should verify the message through an official channel, rather than relying on details that could have come from leaked records.
Products Worth Considering
Ledger Flex Crypto Wallet
Logitech MX Vertical Wireless Ergonomic Mouse – Graphite
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How Berlin’s Data Was Stolen
The Senate’s published timeline says data was taken mainly between August 7 and 12, with the breach detected on August 14. The affected departments were disconnected from the state network after discovery. Berlin’s public announcement followed on August 17. The Senate says the state network was not attacked again after August 13; that statement does not by itself explain when the intrusion began or how attackers first gained access.
Berlin’s information security guideline has required authorities since 2017 to provide adequate staff and funding for protection, according to the source material. A 2023 internal information security report, seen by rbb, planned an expansion of systems intended to detect and defend against cyberattacks. In 2024, both affected departments told rbb that funding for IT security had been available only “partly to the required extent.”
Berlin’s 2025 budget cut €2 million from intrusion detection, while the IT service center’s budget line fell from €32.2 million to €18.2 million, according to netzpolitik.org. Those budget changes provide financial context, but the available reporting does not establish that they caused the 5% license coverage or determine which decision led to the limits on deployment.
What Coverage Could Have Changed
The central counterfactual remains unanswered: would broader device detection have changed the outcome? The reporting establishes that coverage was limited and that the identified entry computer and data-exit servers were outside it. It does not establish whether coverage of those systems would have raised an alert during the August intrusion, how quickly staff could have acted, or whether the theft could have been contained.
It is also unclear from the supplied material how the attackers first accessed the network, how long they were present before data theft began, and what technical controls or logs were available on the uncovered systems. The exact number of files and the full population of affected people remain uncertain: reports cite about 1.4 million files, while Hauer has given a figure of roughly 1.3 million after a second batch. The Senate expects citizen and company data to be involved but has not provided a complete inventory here.
Although Berlin’s earlier budget reductions are relevant context, no source cited in the material demonstrates that those cuts caused the limited license deployment. Nor is there a reported final finding tying a specific budget decision to the breach or its scale.
Follow-Up on Coverage and Exposure
The key next steps are further disclosure about the breach investigation, the departments’ monitoring arrangements, and the scope of affected records. Berlin’s account of the files and its estimate of who may be affected could change as the material is reviewed. The supplied source material does not identify a publication date for a final forensic report or a confirmed schedule for expanding device coverage.
For affected people, the immediate concern is misuse of exposed personal information. The source material advises recipients to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These are precautionary steps, not confirmation that a particular person’s account or identity has been used fraudulently.
Public attention is also likely to focus on whether Berlin expands monitoring beyond the current reported coverage and how it will fund that work. Until the city provides further technical and budget details, it remains unknown whether broader detection would have changed this attack’s course.
Key Questions
What did the rbb24 investigation report about Berlin’s detection system?
It reported that the system introduced in 2026 had licenses for 5% of devices in the urban development department. The department said extending coverage to all devices was not possible for financial reasons.
Were the devices involved in the reported data theft covered?
According to the reporting, neither the computer identified as the entry point nor the servers from which data left were among the devices covered by the system’s licenses.
How much data did Rhysida publish?
Reports cited about 1.4 million files. Berlin’s Chief Digital Officer Florian Hauer has also described roughly 1.3 million files after a second batch, so the figures differ in the available accounts.
Would broader detection have prevented the attack?
That has not been established. The coverage gap is documented in the reporting, but there is no confirmed evidence that a wider deployment would have detected the attackers in time or prevented the data from being copied.
Verify it through an official contact channel. The source material also advises changing passwords, enabling two-factor login, monitoring bank statements and reporting suspected misuse to police. Leaked information may make scam messages appear more convincing.
Source: ThorstenMeyerAI.com
