🔍 Read the full analysis: Why 5% Device Coverage Matters In The Rhysida Berlin Case on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster reported that Berlin’s attack-detection software covered only 5% of devices in the Senate Department for Urban Development, Building and Housing. The two departments hit by Rhysida lost about 1.4 million files, but the available material does not establish that the limited coverage caused the breach or that broader coverage would have stopped it.
Berlin’s Rhysida ransomware case has drawn new scrutiny after public broadcaster rbb24 reported that cyberattack-detection software in the Senate Department for Urban Development, Building and Housing covered licenses for just 5% of its devices. The August attack also affected the Senate Department for Mobility, Transport, Climate Protection and Environment, and about 1.4 million files were later published online. The reporting raises questions about the reach of Berlin’s security monitoring, but does not establish that limited coverage caused the breach.
According to Berlin Senate information cited by rbb24, the main period of data theft ran from August 7 to August 12, 2026. The attack was detected on August 14. The two departments were disconnected from the state network as a precaution, and some services were limited while they worked by phone, rbb24 reported. The Senate made the incident public three days after detection.
Berlin refused Rhysida’s demand for 30 bitcoin, which authorities described as about two million euros. The group published the stolen material on September 4. Reports describe roughly 1.4 million files, including personnel documents, scanned identity cards, payslips, contracts and building-project information. The Senate said the data consisted mainly of unstructured files from employee shared and personal directories, and said information relating to citizens and companies may also be affected.
In its October investigation, rbb24 reported that the detection system introduced in 2026 had licenses for only 5% of devices in the urban development department. The department told the broadcaster that expansion to all devices was not possible “for financial reasons,” according to the source’s translation. Neither the PC identified as the attackers’ entry point nor the servers from which data was taken were covered, rbb24 reported. The available account does not specify the monitoring coverage in the second department.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Coverage Gaps and Breach Detection
The 5% figure matters because monitoring tools can only alert staff to activity on the devices they cover. If the broadcaster’s account is accurate, the system was absent from both the reported entry point and the servers involved in the data leaving the network. That makes the licensing limit relevant to questions about whether Berlin’s defenses could see suspicious activity across the systems that mattered in this incident.
It is not proof that broader coverage would have prevented the theft. Detection software is one part of security; its value depends on what it monitors, what activity it records, how alerts are handled and how quickly staff can respond. The confirmed timeline shows that data was taken over several days before the attack was detected. It does not, by itself, show which security measure failed or whether an earlier alert would have stopped the copying.
The consequences reach beyond government IT. Leaked identity and personnel records can expose employees and other affected people to impersonation attempts, targeted scams or privacy harms. Building and infrastructure documents may also be sensitive. Berlin’s refusal to pay did not prevent publication, while the size and contents of the leak make it important for people to treat unexpected messages that refer to personal details with caution.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
Berlin’s Senate said the main data outflow took place between August 7 and 12, and that the state network was not attacked again after August 13. The attack was noticed the following day. The two departments were disconnected from the network for safety, and the Senate disclosed the incident publicly on August 17, according to the supplied reporting.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin. After Berlin declined to pay, the group posted the files on September 4. Berlin Chief Digital Officer Florian Hauer later described the total as roughly 1.3 million files after a second batch; the source material says most outlets reported about 1.4 million, so the exact count varies by account.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature in the leak. Her department confirmed that she was affected. The report also described emails belonging to her predecessors and sensitive employee records. Separately, Berlin’s 2025 budget reduced funding for intrusion detection by €2 million and lowered the IT service center budget line from €32.2 million to €18.2 million, according to netzpolitik.org. The supplied material does not establish that those budget changes caused the 5% license coverage.
What the Coverage Figure Cannot Prove
The reporting establishes that the detection system covered 5% of devices in one department, and that the reported entry PC and data-bearing servers were outside that coverage. It does not establish whether the system would have identified Rhysida’s activity if installed on those devices, whether alerts would have been acted on in time, or what other monitoring was in place.
It is also unclear from the available material exactly how many people or organizations are represented in the leaked files, which records belong to each affected group, and whether all published material has been identified. The source says the Senate expects citizens’ and companies’ data to be affected, but does not give a confirmed total. The precise file count is also reported differently by Hauer and other outlets.
Finally, the budget cuts and the limited licenses are both reported, but a direct causal link between them has not been demonstrated. The record provided does not explain the department’s full procurement decisions, the coverage in the transport department, or the outcome of any complete post-incident technical investigation.
Reviewing Exposure and Security Coverage
The next questions for Berlin are whether affected people can be identified and notified, what additional records have been confirmed in the leak, and what steps the administration will take to extend or otherwise improve monitoring. The supplied reporting does not give a timetable for those decisions or describe a completed review of the detection system.
People who may be affected should follow official guidance: verify messages claiming to come from public authorities, change reused or exposed passwords, enable two-factor authentication where available, monitor bank statements and report suspected misuse to police. These steps do not confirm that a particular person’s information was stolen; they are precautions while the scope of exposure remains unresolved.
Key Questions
What does the 5% figure refer to?
It refers to the share of devices covered by licenses for the cyberattack-detection system in Berlin’s Senate Department for Urban Development, Building and Housing, according to rbb24. The available reporting does not give the corresponding percentage for the other affected department.
When did Berlin detect the Rhysida attack?
The attack was detected on August 14, 2026. Berlin Senate information cited in the reporting places most of the data outflow between August 7 and August 12.
What information was published?
Reports describe about 1.4 million files, including personnel records, scanned identity cards, payslips, contracts and building-project information. The Senate said the files were mainly unstructured data from employee directories and expected that citizens’ and companies’ information may also be affected.
Did the limited coverage cause the breach?
That has not been established. The reported entry PC and servers from which data was taken were outside the system’s 5% coverage, but the available material does not show whether broader coverage would have detected or stopped the attack.
What should potentially affected people do?
Follow official guidance: verify messages claiming to be from authorities, change passwords that may have been exposed or reused, enable two-factor authentication, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
