🔍 Read the full analysis: Can AI Help Close The Gaps In Berlin’s Attack Detection? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate Department for Urban Development told rbb24 that its 2026 attack-detection system covered licenses for only 5% of its devices, including neither the reported entry computer nor the servers from which data was taken. The disclosure follows a ransomware attack that Berlin noticed on August 14 and a September 4 leak of about 1.4 million files; whether budget cuts caused the limited coverage has not been established.
Berlin’s attack-detection system covered licenses for only 5% of devices in its Senate Department for Urban Development, Building and Housing, rbb24 reported, and the coverage did not include the computer identified as the attackers’ entry point or the servers from which data was taken. The disclosure helps explain a major gap in the response to an August ransomware attack that exposed data from two Senate departments and led to about 1.4 million files being published online.
The Berlin Senate says most of the data was copied between August 7 and 12, 2026. The attack was noticed on August 14, after which the two departments were disconnected from the state network as a precaution. Berlin made the incident public three days later. The Senate says the state network was not attacked again after August 13.
The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and the Environment. According to reporting by rbb24 and Tagesspiegel, the stolen material included personnel records, scanned identity cards, payslips, contracts and building information. The Senate describes the files as mainly unstructured data from employees’ shared and personal directories, rather than information taken from specialist applications. It expects that citizens’ and companies’ data may also be affected.
In late August, Governing Mayor Kai Wegner confirmed Berlin was being blackmailed. The Senate Chancellery said the group Rhysida demanded 30 bitcoin, then worth about €2 million. Berlin refused to pay, and Rhysida published files on September 4. The Senate’s chief digital officer, Florian Hauer, has referred to roughly 1.3 million files after a second batch; about 1.4 million is the figure reported by several outlets.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Device Coverage Matters
The disclosure points to a practical limit on what a detection system can do: it cannot alert defenders to activity on devices it does not monitor. In this case, rbb24 reported that the system covered only 5% of devices at the urban development department, and that the reported entry computer and data-export servers were outside that group. The report does not establish that broader coverage would certainly have stopped the attack, but it raises questions about whether the system could see the activity that mattered.
That matters beyond Berlin because public agencies hold information that can expose employees and residents to identity fraud, targeted scams and misuse of sensitive records. rbb24 reported in October that the leak contained a copy of Transport Senator Ute Bonde’s ID card and a stored copy of her digital signature; her department confirmed she was affected. The reporting also identified emails belonging to her predecessors. The exposed material may help criminals make messages appear credible, though the source material does not establish that leaked information has been used in subsequent fraud.
The incident also puts the cost of cybersecurity choices under scrutiny. Berlin’s limited license coverage was attributed by the department to financial reasons. That explanation shows a resource constraint, but the available reporting does not show that a particular budget decision caused the coverage gap or that spending more would have prevented the breach. The immediate issue is whether authorities can monitor the systems through which sensitive information is accessed and transferred.
Products Worth Considering
Dell P2725H 27-Inch Full HD Monitor
FLEXISPOT EN1 Electric Standing Desk, 48 x 24 in, Black
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
From August Breach to October Findings
The attack unfolded over several weeks before the detection gap became public. Berlin says data left the network mainly from August 7 to 12; officials noticed the attack on August 14 and isolated the two departments from the state network. rbb24 reported that some citizen services were limited while the departments worked by phone. The state’s public announcement followed on August 17.
After Berlin declined to pay Rhysida’s demand, the group posted the stolen files on September 4. Subsequent reporting described sensitive personal and administrative material among the files. On October 21, rbb24 published its findings on the senator’s identification documents and the detection-system licenses, bringing attention to how limited device coverage intersected with the breach.
There was also an earlier budget debate. In November 2024, netzpolitik.org reported that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The relationship between those budget changes and the 5% license coverage has not been established. Separately, the department told rbb that extending the system to all devices was not possible “for financial reasons.”
What the Coverage Gap Cannot Prove
The reporting identifies a serious coverage limitation, but it does not show that the system would have detected or stopped the attackers if more devices had been licensed. Details about how the intruders gained access, how they moved through the network and what alerts were generated are not fully available in the source material. Nor is it clear whether other monitoring tools detected any part of the attack before August 14.
It also remains unclear how many people and organizations are affected. Berlin expects citizens’ and companies’ data to be among the stolen material, while reports identify specific categories of sensitive records. The Senate has said Hauer described the data as carrying at most the lowest of four classification levels; that does not mean the files pose no privacy or security risk. The reported connection between the 2025 budget cuts and the 5% coverage figure remains unproven.
Further Disclosure and Security Steps
Berlin’s next public task is to clarify the scope of the exposed data and explain what technical and organizational changes are being made after the breach. The source material does not provide a published timetable for expanding detection coverage, a final count of affected people, or a complete account of the attackers’ route through the network. Those details will be needed to judge whether monitoring has been extended to the devices and servers that handle sensitive information.
People who may be affected should be alert to messages that use personal details or claim to come from a Berlin authority. The official guidance cited in the source material is to verify such messages independently, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. These steps can reduce risks, but they cannot establish whether an individual’s information was included in the leak.
For the city, the unresolved question is not simply how many detection-system licenses were purchased, but whether security monitoring covers the systems where attackers can enter, move and take data. Berlin’s account and any further investigation findings should clarify what failed, what has changed and whether the departments’ systems now have broader coverage.
Key Questions
What did the Berlin attack-detection system cover?
According to the urban development department’s statement to rbb24, licenses covered 5% of its devices. The reported entry computer and the servers from which data was taken were not among the covered devices.
What information was stolen and published?
Reports described about 1.4 million files, including personnel records, scanned ID cards, payslips, contracts and building-related information. The Senate says the files mainly came from employees’ shared and personal directories. The full list of affected people and organizations is not known from the available reporting.
Did Berlin pay Rhysida?
No. Berlin refused the group’s demand for 30 bitcoin, which the Senate Chancellery valued at about €2 million at the time. Rhysida published the files on September 4, 2026.
Did budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget included reported reductions to intrusion detection and the IT service center, but the available reporting does not prove those cuts caused the 5% coverage. The department said full device coverage was not possible “for financial reasons.”
What should people potentially affected do?
Follow the official advice cited in the source material: verify messages claiming to come from authorities, change passwords, turn on two-factor login, watch bank statements and report suspected misuse to police. These precautions do not confirm whether a person’s data was leaked.
Source: ThorstenMeyerAI.com
