🔍 Read the full analysis: What Happens When Attack Detection Covers Only 5% Of Devices? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin said an attack-detection system introduced in 2026 had licenses for only 5% of devices in the Senate Department for Urban Development, Building and Housing. The PC attackers used to enter and servers from which data was taken were not covered; Rhysida later published about 1.4 million files stolen from two departments. The department cited financial reasons for the limited coverage, but the available reporting does not establish that a specific budget cut caused it.
Attack detection covered only 5% of devices in Berlin’s Senate Department for Urban Development, Building and Housing when attackers stole data from two state departments in August 2026, according to an investigation by public broadcaster rbb24. The department said wider coverage was not possible “for financial reasons”; neither the computer identified as the attackers’ entry point nor the servers used to take data were covered.
The Berlin Senate said the main outflow of data took place from August 7 to 12, and the attack was noticed on August 14. The affected departments were Urban Development, Building and Housing, and Mobility, Transport, Climate Protection and Environment. Both were disconnected from the state network as a precaution, and some citizen services were temporarily limited, rbb24 reported. The Senate said the network was not attacked again after August 13.
The ransomware group Rhysida demanded 30 bitcoin, which Berlin officials put at about €2 million. Berlin refused to pay. On September 4, the group published files online. Reports put the total at about 1.4 million files; Berlin Chief Digital Officer Florian Hauer previously described roughly 1.3 million after a second batch. The material reported to be in the leak includes personnel records, scanned identity documents, payslips, contracts and information about building projects and critical infrastructure. The Senate described the data as mainly unstructured files from employees’ shared and personal directories.
In its October 21 report, rbb24 said the leak included a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature. Her department confirmed she was affected. The Senate has said citizens’ and companies’ data may also be involved. It is not clear from the available reporting how many people have been affected or whether all exposed material has been identified.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Limited Detection Coverage
The reported coverage gap matters because a detection system can alert staff only about activity it can see. In this incident, according to rbb24, the computer identified as the entry point and the servers data left from sat outside the system’s licensed coverage. That does not establish that broader coverage would have prevented the theft, but it means the system was not monitoring the devices most directly associated with the reported intrusion and data loss.
For people whose records were exposed, the leak creates a risk that personal details could be used in targeted scams or attempts at identity misuse. The source report advises recipients to verify messages claiming to come from authorities, change passwords, use two-factor authentication, monitor bank statements and report suspected misuse to police. Those precautions do not confirm that anyone’s accounts have been accessed; they address the risks created by exposed information.
The case also raises a public-sector oversight question: whether security spending and deployment plans match the systems that hold sensitive information. Berlin’s stated financial constraint is a reported explanation for limited licenses, not proof that a particular budget decision caused the incident or that spending alone would have stopped it.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The August Attack and September Leak
Berlin’s administration detected the incident on August 14, 2026, after most of the reported data transfer had already occurred. The Senate made the attack public three days later. The two departments were isolated from the state network, while staff temporarily relied on phones and some services were restricted, according to rbb24. In late August, Governing Mayor Kai Wegner confirmed the blackmail demand; Berlin declined to pay before the September 4 publication.
The documents reportedly include sensitive employment and personal records, as well as files about public projects. The Senate said the stolen material was predominantly unstructured data rather than information taken from specialist applications. Hauer told a legislative committee that the files were classified at no higher than the lowest of four classification levels, according to the source report. That classification does not mean the contents were harmless: reporting identified personal documents and data about infrastructure projects.
Berlin’s 2025 budget included a €2 million reduction for intrusion detection, while the IT service center’s budget line fell from €32.2 million to €18.2 million, netzpolitik.org reported in November 2024. The available material does not establish that those cuts caused the five-percent license coverage. The department also told rbb in 2024 that funding for IT security was available only partly to the extent it considered necessary. Berlin’s information security guideline has required authorities since 2017 to provide adequate resources for protection, according to the source report.
What the Coverage Figure Does Not Show
The reported five-percent figure applies to devices in the urban development department; the supplied reporting does not give an equivalent coverage figure for the second affected department. It also does not specify the full device count, the detection system’s technical capabilities, or how its coverage was measured. The report says the entry computer and data-exit servers were outside coverage, but does not establish whether other monitoring systems or safeguards detected any part of the activity.
It remains unclear exactly how many individuals and organizations had information exposed, whether the published files represent the full stolen dataset, and whether additional batches will appear. The difference between Hauer’s reported count of roughly 1.3 million files and the commonly reported total of about 1.4 million has not been explained. The available reporting also does not link the 2025 budget reductions directly to the limited licenses or show that those reductions caused the attack or its scale.
Follow-Up on Exposed Records and Security
Berlin’s next tasks are to identify whose information appears in the published files, notify affected people and organizations, and investigate how the attackers entered and moved data through the network. The supplied reporting does not give a deadline for completing that work or describe any final findings on the breach’s full scope.
Readers whose information may be involved should treat unexpected messages using personal details with caution, verify requests through official contact channels, change reused passwords, enable two-factor authentication and monitor financial accounts. These are precautionary steps, not evidence that a particular person’s account has been compromised. Further reporting from Berlin authorities and the affected departments will be needed to clarify the number of people affected, the systems involved and whether detection coverage has since changed.
Key Questions
What does the 5% figure mean?
Rbb24 reported that licenses for the attack-detection system covered 5% of devices in Berlin’s urban development department. The report says the computer identified as the entry point and the servers used to take data were not covered.
How much data did Rhysida publish?
Most reports cited in the source put the leak at about 1.4 million files. Chief Digital Officer Florian Hauer was reported as giving a figure of roughly 1.3 million after a second batch; the difference has not been explained.
What information was exposed?
Reports describe personnel files, scanned identity documents, payslips, contracts and files about building projects and critical infrastructure. The Senate said citizens’ and companies’ data may also be affected, but the number of people involved is not yet clear.
Did Berlin’s budget cuts cause the limited coverage?
That has not been established. Berlin’s 2025 budget cut funding for intrusion detection, but the available reporting does not show that those reductions caused the department to license the system for only 5% of devices.
What should people do if they may be affected?
Verify messages claiming to come from authorities through official channels, change reused passwords, enable two-factor authentication, watch bank statements and report suspected misuse to police. These steps are precautionary; they do not mean an account has been compromised.
Source: ThorstenMeyerAI.com
