🔍 Read the full analysis: Could Better AI Monitoring Have Helped Berlin Detect Rhysida? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Rhysida stole and later published about 1.4 million files from two Berlin government departments after a cyberattack in August 2026. An rbb24 investigation reported that one department’s newly introduced detection system covered licenses for only 5% of its devices, and neither the identified entry PC nor the servers used to transfer data were covered. The reporting raises questions about monitoring coverage, but does not establish that budget cuts caused the limited deployment or that broader monitoring would have prevented the theft.
Berlin’s August 2026 Rhysida attack went undetected while data was copied from two Senate departments, and an rbb24 investigation published October 21 found that the detection system at one department covered licenses for only 5% of its devices. The identified entry computer and the servers from which data left were outside that coverage; the findings raise questions about monitoring, but do not establish that wider coverage would have stopped the breach.
The Senate says most of the data transfer occurred from August 7 to 12, and the attack was noticed on August 14. The affected offices were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. The departments were disconnected from Berlin’s state network as a precaution, temporarily limiting some public services, rbb24 reported. The Senate said the state network was not attacked again after August 13.
Berlin did not pay the 30 bitcoin ransom demand, which the Senate Chancellery put at about two million euros. Rhysida published files on September 4. Berlin officials described the leak as roughly 1.3 million files after a later batch; many reports, including rbb24’s, put the total at about 1.4 million. The Senate described the material as mainly unstructured files from employees’ shared and personal directories, rather than data from specialist applications.
Reporting by rbb24 and Tagesspiegel identified personnel records, scanned identity documents, payslips and other sensitive material among the files. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature; her department confirmed she was affected. The Senate has said data belonging to citizens and companies may also be involved. The full scope and the number of people affected have not been established in the supplied reporting.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Device Coverage Matters
The reported gap matters because monitoring can only raise an alert about activity on systems it covers. In this incident, the entry PC and servers involved in the data transfer were reportedly outside the system’s licensed coverage. That makes the five-percent figure more than a general budget statistic: it points to a potential blind spot on devices central to the intrusion, though it does not by itself show what alerts would have been generated under broader deployment.
For people whose records were exposed, the leak creates risks beyond the original theft. Identity details and employment information can be used to make fraudulent messages appear credible. The source material advises recipients to verify messages said to come from authorities, change passwords, use two-factor authentication, monitor bank activity and report suspected misuse to police. People should treat such messages cautiously rather than assume any particular scam has already occurred.
The episode also poses a practical question for public agencies and other organizations: whether security tools are deployed across the systems that hold sensitive information and carry data out. A purchase or rollout alone does not show effective protection. Coverage, logging, response procedures and network separation all affect whether an intrusion is detected and contained, but the available reporting does not assess all of those controls in Berlin.
Popular right now
Philips 2200 Series Fully Automatic Espresso Machine with Classic Milk Frother
Hisense 85 U7 Mini-LED ULED 4K UHD Smart Google TV (85U7SG, 2026)
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
How the Breach Unfolded
Berlin made the incident public on August 17, three days after it was detected. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed. The Senate Chancellery said Rhysida sought 30 bitcoin; after Berlin refused, the group posted files online on September 4. The departments’ network disconnection was a containment step, but it came after the Senate’s stated period of major data outflow.
The rbb24 investigation traced the monitoring issue to the urban development department’s account of its detection system. The department said the system was introduced in 2026 but licenses covered 5% of all devices; it could not extend coverage to every device “for financial reasons,” according to the source’s translation. The reporting says neither the computer identified as the entry point nor the servers from which files left were included.
There is a wider budget backdrop, but a direct causal link has not been shown. Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center budget line from €32.2 million to €18.2 million, according to netzpolitik.org’s November 2024 reporting. The departments had also told rbb in 2024 that funds for IT security were available only partly to the required extent. The source material does not establish that these budget changes caused the five-percent license coverage.
What the Monitoring Gap Proves
The investigation establishes that licenses covered a small share of devices in one department and that the identified entry PC and data-transfer servers were not among them. It does not establish that broader monitoring would have detected the intrusion in time, prevented the theft or reduced the amount of data taken. The reporting supplied here does not detail what telemetry the system collected, how alerts were handled, or whether other security controls were operating on the uncovered devices.
It is also unclear exactly how many individuals’ records were exposed, whether all posted files were downloaded by others, and how much citizen or company data is included. The reported totals differ: Berlin officials cited roughly 1.3 million files after a second batch, while many accounts reported about 1.4 million. Those figures count files, not people. Finally, the available evidence does not show that the 2025 budget reductions caused the limited license coverage.
Berlin’s Security Review Ahead
The next public milestones are fuller findings on the incident’s scope and any steps Berlin takes to close monitoring gaps. The source material does not provide a date for a final investigation, a complete affected-person count, or a published plan to extend licenses across the departments. Those details will help establish whether the immediate response leads to changes in coverage, funding or incident handling.
Meanwhile, people who may have records in the leak can follow official guidance: check that messages claiming to come from government offices are genuine, change reused or exposed passwords, activate two-factor login where available, watch financial statements and report suspected identity misuse to police. The confirmed publication of files warrants caution, but individual exposure should be checked against official notices rather than inferred from the overall file count.
Key Questions
What happened in the Berlin Rhysida attack?
Rhysida accessed systems linked to two Berlin Senate departments and copied data, most of it between August 7 and 12, 2026, according to the Senate. Berlin noticed the incident on August 14. After the city refused a ransom demand, Rhysida published files on September 4.
What does the 5% figure mean?
According to rbb’s reporting, licenses for the detection system introduced at the urban development department covered 5% of its devices. The identified entry PC and the servers from which data left were not covered. The report does not state that this was the coverage level across both departments.
Would broader AI monitoring have stopped the attack?
The available reporting cannot establish that. It describes limited coverage of a detection system, but does not show that broader coverage would have produced a timely alert or prevented the data theft. The source material also does not establish that the system was specifically AI-based.
What information was published?
Reports describe personnel files, scanned ID cards, payslips, contracts and other documents. rbb24 reported that a copy of Senator Ute Bonde’s ID card and a stored digital signature were among the leaked material; her department confirmed she was affected. The full list of exposed records and the number of people affected remain unclear.
What should people do if they may be affected?
Follow official notices, verify messages claiming to come from authorities, change passwords that may have been exposed or reused, turn on two-factor authentication, monitor bank statements and report suspected misuse to police. The published file count does not establish whether a specific person’s data was included.
Source: ThorstenMeyerAI.com
