🔍 Read the full analysis: What Limited Attack Detection Reveals About AI Security In Berlin on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Berlin’s Senate Department for Urban Development, Building and Housing told public broadcaster rbb that its 2026 attack-detection system had licenses for only 5% of its devices. Neither the PC identified as the attackers’ entry point nor the servers from which data was taken were covered; the broader attack exposed about 1.4 million files, according to reporting cited by the source.
Berlin’s attack-detection system covered licenses for just 5% of devices in the Senate Department for Urban Development, Building and Housing, and did not cover the PC identified as the attackers’ entry point or the servers from which data was taken, according to an rbb investigation published in October. The disclosure sheds light on a major breach of two Berlin government departments in which attackers stole files later published online.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate said most of the data left the network between 7 and 12 August 2026. The breach was detected on 14 August, and the Senate made it public three days later. The departments were disconnected from the state network as a safety measure, temporarily relying on phone-based work while some public services were restricted, rbb24 reported.
The ransomware group Rhysida demanded 30 bitcoin, described by the Senate Chancellery as about €2 million. Berlin refused to pay. On 4 September, Rhysida published the stolen files online. Reports cited by the source put the total at about 1.4 million files, including personnel records, scanned identity documents, payslips and contracts. The Senate said the material was mainly unstructured data from staff shared and personal directories, rather than information from specialist applications.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leaked material. Her department confirmed that she was affected. The Senate has said it expects data belonging to citizens and companies may also be involved. It has described the files as carrying no more than the lowest of four classification levels, but that classification does not establish that the exposed personal information is harmless.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Five Percent Coverage Matters
The disclosure points to a gap between having security software and having it monitor the systems that matter. The department told rbb that it introduced the detection system in 2026 but could not extend coverage to all devices “for financial reasons”, translated from the department’s statement. According to the investigation, the entry PC and the servers involved in the data transfer were outside the licensed coverage.
Detection tools can only alert defenders to activity on systems they can observe. In this case, the coverage limitation is relevant because the attack’s main data outflow continued for several days before officials noticed the breach. The available reporting does not establish that broader coverage would have prevented the theft, or that the tool would necessarily have detected it. It does show that the devices identified as central to the incident were not covered by this system.
For people whose information was exposed, the publication of identity documents and other personal records can create risks of impersonation and targeted scams. The leaked material also included sensitive government and infrastructure-related information, according to reporting cited by the source. The full reach of the breach remains undetermined, so affected individuals and organizations may not yet know which records were exposed.
Products Worth Considering
Samsung 34-Inch ViewFinity S50GC Ultra-WQHD Monitor
Dell 24 Plus Monitor S2425HSM – 23.8 FHD (1920×1080) 144Hz 1ms, 2 x 3W Speakers, HDMI, Height/Tilt/Pivot/Swivel Adjustability, AMD FreeSync
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
As an affiliate, we earn on qualifying purchases.
The Breach and Budget Timeline
Berlin’s Senate said the main data transfer took place from 7 to 12 August and that the state network was not attacked again after 13 August. Officials detected the incident on 14 August. In late August, Governing Mayor Kai Wegner confirmed that the city was being blackmailed. After Berlin declined to pay the ransom, the files appeared online on 4 September.
The 5% figure comes from the department’s response to rbb, not from an independently published device-by-device audit. The same source says Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. Those budget decisions preceded the attack, but the reporting does not establish that they caused the limited licensing or the breach.
There were earlier warnings about security resources. Both departments told rbb in 2024 that funding for IT security was available only “partly to the required extent,” in translation. A 2023 internal security report, seen by rbb, had proposed expanding systems to detect and defend against cyberattacks. Berlin’s information-security guideline has required authorities since 2017 to provide adequate staff and funding for protection, according to the source material.
What the Investigation Cannot Establish
The available reporting does not establish whether broader detection coverage would have identified the attackers earlier or stopped the data theft. It also does not establish that the 2025 budget reductions caused the 5% licensing limit; the department’s stated reason was financial, but the direct link to specific budget decisions has not been confirmed.
The total number of affected people and organizations, and the complete contents of the published files, remain unclear. Reports give a figure of about 1.4 million files, while Berlin’s Chief Digital Officer Florian Hauer was reported to have cited roughly 1.3 million after a second batch. Those counts are not directly reconciled in the source material. The Senate expects citizens’ and companies’ data may be affected, but has not identified the full population of people whose information was exposed.
Follow-Up on Exposed Records
The next key development is any fuller account from Berlin of which people, businesses and records were affected, alongside updates on the investigation and the response to the leaked data. The source material does not give a date for a final incident report or specify whether the detection system will be expanded across the departments.
People who may be affected can follow official notices and verify unexpected messages claiming to come from government agencies. The source material also cites advice to change passwords, turn on two-factor authentication, monitor bank statements and report suspected misuse to police. These precautions do not confirm that a particular person’s information was included in the leak.
Key Questions
What did rbb report about Berlin’s attack-detection system?
rbb reported that the system introduced in 2026 had licenses for 5% of devices in the urban development department. The department said extending it to all devices was not possible for financial reasons.
Were the systems involved in the attack covered?
According to the rbb investigation, neither the PC identified as the entry point nor the servers from which data was taken were covered by the system’s licenses.
How much data was published, and what did it contain?
Reports cited in the source material put the leak at about 1.4 million files. They included personnel records, scanned identity documents, payslips and contracts, among other material. The complete contents and number of affected people are not known.
Did Berlin pay Rhysida’s ransom?
No. Berlin refused the demand for 30 bitcoin, described as about €2 million. Rhysida published the files on 4 September 2026, according to the source material.
Has Berlin confirmed that budget cuts caused the coverage gap?
No. The department cited financial reasons for not extending licenses, and reporting identified earlier budget reductions. The available information does not establish that those specific cuts caused the 5% coverage level.
Source: ThorstenMeyerAI.com
