🔍 Read the full analysis: Was Monitoring 5% Of Devices Enough For Berlin’s Administration? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A public broadcaster reported that Berlin’s urban development department licensed cyberattack detection software for just 5% of its devices, and neither the reported entry computer nor the servers involved in the data theft were covered. The finding follows a ransomware attack that exposed about 1.4 million files; why coverage was so limited and whether budget cuts caused it remain unclear.
Berlin’s urban development department had cyberattack detection software licensed for only 5% of its devices when ransomware attackers stole files from two state departments in August, according to an rbb24 investigation published October 21. The department said wider coverage was not possible “for financial reasons”; the computer reported as the attackers’ entry point and the servers from which data was taken were not covered.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Berlin’s Senate says the main data outflow occurred from August 7 to 12, and the attack was detected on August 14. The departments were disconnected from the state network as a precaution, disrupting some services, rbb24 reported.
After the city refused a reported demand for 30 bitcoin, worth about €2 million at the time, the Rhysida ransomware group published files online on September 4. Media reports put the leak at about 1.4 million files. Reporting by rbb24 and Tagesspiegel described personnel records, scanned identity documents, payslips, contracts and material related to building projects and critical infrastructure. The Senate has said the files were mainly unstructured data from employees’ shared and personal directories.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leaked material. Her department confirmed that Bonde was affected. The Senate expects that citizens’ and companies’ data may also be involved, though the full scope has not been established.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Detection Missed the Affected Systems
The reported coverage gap matters because security monitoring can alert an organization to suspicious activity only on systems it can observe. In this incident, the devices identified in reporting as the entry point and the servers used to remove data were outside the software’s licensed coverage. That leaves a basic operational question: how much protection did the system provide when the attack moved across the network?
The consequences are not limited to government IT. Leaked identity and employment records can expose people to impersonation and targeted scams, while compromised internal documents may create risks for public projects and infrastructure. The incident also disrupted some citizen services when departments were isolated from the state network. The reported 5% figure does not, by itself, establish that broader monitoring would have prevented the theft, but it identifies a gap in the detection system’s reach.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Shark Navigator Lift-Away Upright Vacuum, NV360
Samsung 75-Inch M80H Series Mini LED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
From August Intrusion to October Findings
Berlin detected the incident on August 14 and made it public three days later. The Senate says the main theft had already taken place between August 7 and 12, and that the state network was not attacked again after August 13. In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The city declined to pay, and Rhysida published the files on September 4 after its deadline passed.
The coverage question surfaced in rbb24’s October investigation. The urban development department told the broadcaster that the detection system, introduced in 2026, had licenses for only 5% of devices and could not be extended to all devices “for financial reasons.” Separate reporting points to wider funding pressures: a 2025 budget plan cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available information does not establish that those cuts caused the limited licensing.
Berlin’s information security guideline has required authorities since 2017 to provide sufficient staff and funding for protection. An internal 2023 security report, which rbb said it had seen, already proposed expanding systems to detect and defend against cyberattacks. Those earlier commitments provide context, but do not settle why specific devices remained uncovered in August 2026.
“Funds for IT security were available only “partly to the required extent.””
— Berlin’s urban development department, as quoted by rbb in 2024
Funding and Exposure Still Unclear
The public reporting does not explain exactly why only 5% of devices had licenses, how that coverage was selected, or whether other controls detected activity on the systems outside the software’s reach. The precise relationship between Berlin’s budget reductions and the licensing decision has not been established. Nor does the available information show whether broader monitoring would have identified the intrusion in time to stop the data theft.
The number of files reported varies: Berlin’s Chief Digital Officer Florian Hauer cited roughly 1.3 million after a second batch, while most media reports have described about 1.4 million. The full set of people and organizations affected, the complete contents of the leak, and any further misuse have not been confirmed in the source material.
Berlin Must Clarify Coverage and Response
Further clarification from Berlin’s Senate and the affected departments is needed on the devices now covered by detection tools, any steps taken to expand coverage, and the findings of the investigation into the intrusion. The source material does not provide a date for a public audit or a specific deadline for closing the licensing gap. Readers should watch for updates on the scope of exposed records and whether additional files or affected parties are identified.
People who may be affected should treat unexpected messages that use personal details with caution. The advice cited in the source is to verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police.
Key Questions
What did the report say about Berlin’s monitoring coverage?
rbb24 reported that the urban development department had detection software licenses for 5% of its devices. The department said extending coverage was not possible “for financial reasons.”
Were the systems involved in the theft monitored?
According to the report, neither the computer identified as the attackers’ entry point nor the servers from which data was taken were covered by the licensed detection system.
What information was exposed?
Media reports described about 1.4 million files, including personnel records, identity-document scans, payslips and contracts. Berlin says the files were mainly unstructured data from staff directories; the full scope of affected people remains unclear.
Did Berlin pay the ransom?
No. Berlin refused a reported demand for 30 bitcoin, valued at about €2 million at the time. Rhysida published the files on September 4, according to the source material.
Did budget cuts cause the monitoring gap?
That has not been established. Berlin’s 2025 budget plan included cuts to intrusion detection and the IT service center, but the available reporting does not prove those cuts caused the 5% licensing level.
Source: ThorstenMeyerAI.com
