🔍 Read the full analysis: Why Berlin’s Administration Monitored Only 5% Of Devices—and The Cost on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin discovered in August that attackers had stolen files from two Senate departments, and Rhysida later published about 1.4 million files after the city refused a ransom demand. An rbb24 investigation found the attack-detection system in the urban development department covered licenses for only 5% of devices, excluding the reported entry PC and the servers involved in the data theft. The department cited financial limits; whether earlier budget cuts caused that coverage gap has not been established.
Berlin’s attack-detection system covered licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing when attackers stole data from two Senate departments in August, according to an rbb24 investigation. The department said extending coverage to all devices was not possible “for financial reasons”; neither the computer identified as the entry point nor the servers from which data left were covered, leaving questions about how the monitoring gap affected the breach.
The Berlin Senate said most of the data was taken between August 7 and 12, and the attack was detected on August 14. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. They were disconnected from the state network as a precaution, and some public services were limited, rbb24 reported. The Senate said the network was not attacked again after August 13.
In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said Rhysida demanded 30 bitcoin, described at the time as worth about €2 million. Berlin refused to pay; on September 4, the group published the files. The Senate’s Chief Digital Officer, Florian Hauer, referred to roughly 1.3 million files after a second batch, while several reports put the total at about 1.4 million.
Reporting by rbb24 and Tagesspiegel described exposed material including personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate said the files were mainly unstructured data from employee shared and personal directories, rather than specialist applications, and said citizens’ and companies’ data may also be affected. In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s ID card and a stored digital signature in the leak; her department confirmed she was affected.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection
The reported coverage gap matters because the systems that might have helped flag the intrusion did not include either the reported entry computer or the servers from which data was taken. The available information does not establish that broader monitoring would have prevented the theft. It does show that the detection system’s licensed reach did not include devices central to this incident, according to rbb24’s account.
The consequences extend beyond the two departments. The published files reportedly contain personal and employment information, and the Senate expects data belonging to residents and businesses may also be involved. People whose details were exposed may face targeted scam attempts or misuse of identity information. Berlin’s advice, as reported in the source material, is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
The story also puts a concrete figure on a public-sector security decision: licenses covered one device in twenty in the urban development department, while full coverage was ruled out for financial reasons. That figure describes the license coverage reported by the department; it does not establish what other monitoring or security measures were operating across Berlin’s network.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Finding
Berlin detected the incident on August 14, 2026, after most of the reported data outflow had already taken place. The Senate made the incident public three days later. A Tagesspiegel commentary said the departments were informed by the state IT service provider, ITDZ, that they had been hit. In late August, the mayor confirmed the blackmail demand; the files appeared online after Berlin declined to pay.
The monitoring issue emerged later. On October 21, rbb24 reported that the attack-detection system introduced in 2026 had licenses for only 5% of devices in the urban development department. The department attributed the limited coverage to financial constraints. The source material also reports that both departments said in 2024 that funds for IT security were available only partly to the extent required, and that a 2023 internal security report proposed expanding systems to detect and defend against attacks.
Berlin’s 2025 budget reduced €2 million from intrusion detection and lowered the IT service center budget line from €32.2 million to €18.2 million, according to netzpolitik.org. Those budget figures provide relevant context, but the available reporting does not establish that the cuts caused the later 5% license coverage.
“The funds needed for IT security were available only “partly to the required extent.””
— The two departments, speaking to rbb about IT security funding in 2024
What the Coverage Figure Cannot Show
The 5% figure applies to licensed device coverage in the urban development department, as reported by rbb24. The available material does not say how many devices that represented, what monitoring operated on the remaining devices, or whether the other affected department had the same coverage rate. It also does not establish whether wider deployment would have detected the intrusion in time to stop the data loss.
The link between Berlin’s budget decisions and the coverage gap remains unproven. Although the 2025 budget reduced funding for intrusion detection and the IT service center, the source material explicitly says it is not established that those cuts caused the five-percent coverage. The full scope of affected personal, company and public-sector data is also not yet clear. Berlin’s Chief Digital Officer described a lower total than the roughly 1.4 million files reported by several outlets, and the exact number may depend on how batches or files are counted.
Disclosure and Security Follow-Up
Berlin will need to clarify the scope of affected data, which people and organizations are included, and what steps are being taken to protect them. The public information available here does not specify a schedule for expanding detection coverage or identify a completed review of how the entry device and data-transfer servers were left outside the licensed system.
For people who may be affected, the guidance reported by the source is to treat unexpected messages claiming to come from authorities with caution, change passwords, turn on two-factor authentication, check bank statements and report suspected identity misuse to police. Further reporting or official updates may clarify both the number of affected records and whether Berlin plans changes to its monitoring and security budgets.
Key Questions
What did rbb24 report about Berlin’s monitoring system?
rbb24 reported that the 2026 attack-detection system had licenses covering 5% of devices in the urban development department. The reported entry computer and the servers from which data left were outside that coverage.
What happened to the stolen files?
After Berlin refused Rhysida’s demand for 30 bitcoin, the group published files online on September 4, 2026. Reports put the total at about 1.4 million files, though Berlin’s Chief Digital Officer gave a lower figure of roughly 1.3 million after a second batch.
What information was reported in the leak?
Reports described personnel records, scanned IDs, payslips, contracts and building-project information. The Senate said the material was mainly unstructured data from employee directories and warned that data belonging to citizens and businesses may also be affected.
Did Berlin’s budget cuts cause the monitoring gap?
That has not been established. Berlin’s 2025 budget reduced intrusion-detection funding and lowered the IT service center’s budget line, but the available reporting does not show that those cuts caused the department’s 5% license coverage.
What should people do if they may be affected?
The advice reported by the source is to verify messages that claim to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
Source: ThorstenMeyerAI.com
