🔍 Read the full analysis: How Device Monitoring Influenced Rhysida’s Attack On Berlin on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster’s investigation found that Berlin’s cyberattack detection system covered only 5% of devices in the Senate Department for Urban Development, Building and Housing. The department said broader coverage was not possible for financial reasons; the computers used to enter the network and take data were outside that coverage. The disclosure sheds light on a monitoring gap, but does not establish that budget cuts caused it.
Berlin’s device-monitoring gap left the computer identified as the entry point and servers used to remove data outside the detection system’s coverage during the Rhysida ransomware attack, according to an rbb24 investigation published October 21. The Senate Department for Urban Development, Building and Housing told the broadcaster that licenses covered just 5% of its devices, citing financial reasons for not extending coverage.
Berlin’s Senate says most of the stolen data left the state network between August 7 and August 12, 2026. The attack was noticed on August 14, and the city made it public three days later. According to rbb24, both affected departments—the urban development department and the Senate Department for Mobility, Transport, Climate Protection and Environment—were disconnected from the state network as a precaution. Some services were limited while staff worked by phone.
The attackers, identified as the Rhysida ransomware group, demanded 30 bitcoin, which Berlin officials valued at about €2 million. Berlin refused to pay. Rhysida posted the stolen material online on September 4, after its deadline passed. Public accounts describe the leak as roughly 1.4 million files, though Berlin Chief Digital Officer Florian Hauer has also referred to about 1.3 million files after a second batch.
The material reported in the leak includes personnel records, scanned identity cards, payslips, contracts and building plans. rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored digital signature; Bonde’s department confirmed she was affected. Berlin says the files were mainly unstructured material from employees’ shared and personal directories. The Senate expects that citizens’ and companies’ data may also be affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Monitoring Coverage Left a Detection Gap
The reported coverage figure matters because monitoring tools can only alert defenders to activity on systems they can see. In this case, rbb24 reported that the identified entry PC and servers involved in the data outflow were among devices not covered by the system. The gap does not by itself explain how the attackers entered or prove that broader monitoring would have stopped the theft, but it shows that the tool was not watching key parts of the reported attack path.
The breach also has direct consequences for people whose records were exposed. Leaked identity and employment information can be used in targeted scams or attempts to impersonate officials. People who receive messages referring to personal details should verify them through independently confirmed government contact channels, and follow official advice to change passwords, use two-factor authentication, monitor bank statements and report suspected misuse to police.
For public agencies, the episode raises a practical question about how cybersecurity budgets translate into coverage across devices and servers. A tool’s presence in an agency does not mean that all systems are monitored. The relevant measures include which devices are covered, whether logs are reviewed and how quickly alerts can be acted on—details that have not all been made public for this incident.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Attack Timeline and Budget Questions
According to Berlin’s official information page, data exfiltration largely took place from August 7 to August 12, and the state network was not attacked again after August 13. The Senate learned of the incident on August 14. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The city’s refusal to pay preceded the publication of the files on September 4.
The monitoring system was introduced in 2026, but the urban development department told rbb that licenses covered only five percent of its devices. The department said expanding coverage was not possible “for financial reasons,” translated from its statement by the source. A separate report by netzpolitik.org said Berlin’s 2025 budget reduced €2 million from intrusion detection and cut the IT service center’s budget line from €32.2 million to €18.2 million. It has not been established that those budget reductions caused the five-percent coverage.
Berlin’s information security guideline has required authorities since 2017 to provide sufficient staff and funding for protection, according to the source material. An internal 2023 information-security report reviewed by rbb had already called for expanding systems to detect and defend against cyberattacks. These earlier references show that the need for detection had been identified; they do not establish why the 2026 deployment remained limited.
Coverage, Cause and Full Exposure
The public information does not show whether broader monitoring would have detected the attackers in time, prevented the data theft or changed the impact. The reported lack of coverage is a significant gap, but it is not proof that monitoring limits caused the breach. Berlin has also not established a direct link between earlier budget reductions and the five-percent license coverage.
The precise number of files varies across public accounts: most reports cite about 1.4 million, while Hauer was reported as referring to roughly 1.3 million after another batch. The complete number of affected people and organizations, the full contents of the leak and the extent of any misuse are not clear from the available information. Berlin has said citizen and company data may be involved.
Investigation and Support for Those Affected
Berlin’s continuing work will need to establish which people and organizations are affected, what records were exposed and whether the material is being used for fraud or impersonation. Further public statements from the Senate or the two departments could clarify the scope of the leak and the response to the monitoring gap. The available source material does not specify a date for a final investigation report or a full accounting of the affected files.
People who may be affected should watch for suspicious messages or calls that cite personal information, verify claims of contact from authorities using official channels and report suspected misuse to police. Berlin residents should follow guidance issued by the relevant departments as it becomes available. The city’s account of the incident and any later findings will be needed to determine whether monitoring coverage has changed and what protections were added.
Key Questions
What did rbb24 report about Berlin’s monitoring system?
rbb24 reported that the system introduced in 2026 covered 5% of devices at the urban development department. The department said broader coverage was not possible for financial reasons. The reported entry computer and data-transfer servers were outside the system’s coverage.
What information did Rhysida publish?
Reports describe roughly 1.4 million files, including personnel records, identity-card scans, payslips, contracts and building-related material. The full list of affected people and organizations has not been made public in the source material.
Did Berlin pay the ransom?
No. Berlin refused Rhysida’s demand for 30 bitcoin, valued by officials at about €2 million. The group published the files on September 4, 2026.
Did budget cuts cause the monitoring gap?
That has not been established. Berlin’s 2025 budget included cuts to intrusion detection and the IT service center, but the available reporting does not prove those cuts caused the system to cover only 5% of devices.
What should someone do if they may be affected?
Be alert to messages or calls that use personal details, verify claims through independently confirmed official channels, change passwords, enable two-factor authentication, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
