Attack Detection on 5% of Devices: How Rhysida Got Into Berlin’s Administration, and What the Savings Really Cost

By Thorsten Meyer | November 1, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

For about a week in August, data flowed out of two of Berlin’s government departments, and nobody inside noticed. Personnel files, scanned ID cards, payslips, building plans, emergency plans. Then the ransomware group Rhysida asked for 30 bitcoin, about two million euros. Berlin refused, and the files went up on the dark web.

Ten weeks later, a public broadcaster found out why the alarm stayed silent. The software meant to spot such attacks had been rolled out in 2026, but the licenses covered only five percent of the devices in one of the two departments. Extending it to all devices was not possible “for financial reasons”, the department said. The PC the attackers came in through and the servers the data left from were not among the five percent.

This is a story about a cyberattack. It is also a story about a budget line, and about what organizations really save when they save on seeing.

Key takeaways

• The attack: Criminals got into Berlin’s state network and copied data from the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. Most of the data left between 7 and 12 August 2026; the attack was noticed on 14 August (Berlin Senate; rbb).
• The leak: After Berlin refused to pay 30 bitcoin, Rhysida published the files on 4 September: about 1.4 million files, including ID copies and personnel records (Berlin Senate; rbb24; Tagesspiegel). In October, rbb24 found a copy of transport senator Ute Bonde’s ID card and her stored digital signature in the leak.
• The five percent: The attack detection system introduced in 2026 had licenses for only 5% of all devices, the urban development department told rbb; covering all devices was not possible “for financial reasons” (our translation). Neither the entry PC nor the servers the data left from were covered.
• The budget backdrop: Berlin’s 2025 budget cut €2 million from intrusion detection and cut the IT service center’s budget line from €32.2 million to €18.2 million (netzpolitik.org, November 2024). Whether that cut caused the five percent is not established.
• For organizations: Detection that covers a few devices is not detection. Attackers spend days inside before they steal; that is the window where coverage, logging and segmentation pay off.
• For people: Expect scam messages that use leaked details. Official advice: verify any message claiming to be from the authorities, change passwords, turn on two-factor login, watch bank statements, and report misuse to the police.

Products Worth Considering

Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Amazon Kindle Scribe Colorsoft, 64GB, 11-Inch Color Display with Premium Pen

AmazonView Latest Price

DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What happened, in order

Berlin’s administration noticed the attack on 14 August 2026. Both affected departments were cut off from the state network for safety; for a while they worked by phone, and several citizen services were limited, rbb24 reported. The Senate made the incident public three days later.

By then, most of the damage was done. According to the Senate’s official information page, the main data outflow happened between 7 and 12 August, and the state network was not attacked again after 13 August. A Tagesspiegel commentary noted that the two departments had to be told by the state IT service provider ITDZ that they had been hit.

In late August, Governing Mayor Kai Wegner confirmed that Berlin was being blackmailed. The Senate Chancellery said the group demanded 30 bitcoin, about two million euros. Berlin did not pay. On 4 September, after the deadline passed, Rhysida put the files online. Berlin’s Chief Digital Officer Florian Hauer spoke of roughly 1.3 million files after a second batch; most outlets report about 1.4 million.

What is in them? rbb24 found parts of personnel files, scanned ID cards, payslips, job references and contracts, plus information on building projects such as the extension of the Federal Chancellery and data on critical infrastructure. The Tagesspiegel reported birth certificates of employees’ children and rehabilitation records. In the Senate’s description, the files are “predominantly unstructured data from shared and personal directories of employees” (our translation), not data from specialist applications. The Senate expects that data of citizens and companies is affected too. Hauer told the Interior Committee that the stolen files carried at most the lowest of four classification levels.

On 21 October, rbb24 published its investigation: a copy of the ID card of transport senator Ute Bonde (CDU), a stored copy of her digital signature, and emails of her predecessors Manja Schreiner and Bettina Jarasch are in the leak. Bonde’s department confirmed that she is affected.

The five percent

The core of the rbb24 investigation is one sentence from the urban development department. The system for detecting cyberattacks, introduced in 2026, had licenses for only five percent of all devices. Extending it to all devices was not possible “for financial reasons” (our translation). And the systems the attack actually touched were not among them: neither the PC identified as the entry point nor the servers from which data later flowed.

The money problem was known. In 2024, the funds needed for IT security were available only “partly to the required extent”, both departments told rbb (our translation). Berlin’s own information security guideline has required authorities since 2017 to provide enough staff and money for protection. An internal information security report from 2023, which rbb has seen, already planned to expand systems “to detect and defend against cyberattacks”, explicitly to catch attacks early and stop them spreading.

The budget backdrop is public. When Berlin cut its 2025 budget, netzpolitik.org reported, the IT service center’s line fell from €32.2 million to €18.2 million, a cut of about 44%, and €2 million went from IT security, specifically intrusion detection. The Tagesspiegel reports that the CDU-SPD coalition cut more than €50 million from digitalization in the 2026/2027 double budget, and that about two-thirds of Senate departments and state agencies still run their own IT security instead of the central provider.

Two honest limits. First, the five percent comes from the department’s answer to a journalist. When Green MP Stefan Ziller asked the Senate in parliament how far intrusion detection has been rolled out, the answer of 21 October declined to say: specific information is withheld “in order not to offer attackers any potential attack vectors” (Drucksache 19/27250, our translation). Second, the €2 million cut was in the central IT budget, while the five percent concerns one department’s licenses. The taz links the two; the documents I read do not prove the link.

What attackers do in the quiet days

Why does detection matter so much if the attacker is already inside? Because a break-in is not the theft. The theft comes later.

The federal cyber security agency BSI published an advisory on 4 September about a German state institution whose network was compromised in August. It describes an attack class called TerminalFix, which the BSI calls a further development of ClickFix: a fake CAPTCHA on a website tells the user to run a command to “prove they are human”. After that, according to the BSI, the malware settles in, then explores the network: domains, user rights, servers, backup systems. Attackers may set up cloud storage to move data out and open a hidden tunnel to their own servers. The BSI attributes a malware family used in these attacks to the same financially motivated group it holds responsible for the Rhysida ransomware and leak site.

Did Berlin’s attack follow that pattern? The BSI did not confirm it to rbb. It only said it is “in close contact” with Berlin. rbb also reports that the BSI had warned about ClickFix repeatedly since at least March 2025, including in daily situation reports sent to the federal states. Whether those warnings reached the two departments, neither the ITDZ nor the Senate Chancellery would say.

Each of those steps, the strange command on a PC, the scan of the network, the bulk copying to cloud storage, leaves traces on the device where it happens. That is what endpoint detection and response (EDR) software watches for. The US advisory on Rhysida says EDR tools “are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.” On a device without the sensor, there is nothing to see.

Who is Rhysida?

According to the joint advisory by the FBI, CISA and MS-ISAC, last updated in April 2025, Rhysida ransomware has been used since May 2023 mainly against education, healthcare, manufacturing, IT and government. The actors hit “targets of opportunity” and have been seen working as ransomware-as-a-service, renting their tools to affiliates. Common ways in include stolen valid credentials for remote access where multi-factor login was not switched on. Once inside, they use the network’s own admin tools to blend in.

The BSI ties the Rhysida leak site to a group known as Vice Spider (also Vice Society), active since at least mid-2021. Citing a commercial provider, it says 92% of victims named on the Rhysida leak site later see their data published, on average 11 days after being named. Berlin’s Senate says there is no evidence of links to the Russian state, but it “cannot be ruled out” (our translation). The BSI says it has found no connection to state actors.

The false economy

What did the savings buy? A budget line that looked smaller. What did they cost? Nobody has published a total. Here is what is known.

Two departments were isolated and citizen services limited. Three external forensics firms ran incident response around the clock, according to the Senate’s answer in parliament. Berlin brought in CrowdStrike, first for forensics and then as an external monitoring service; Hauer called it an “alarm system” and a stopgap until Berlin improves its own intrusion protection. Hauer said AI tools would sort more than a million leaked files by risk so the most dangerous ones get checked first. Hundreds of citizens and employees have written in. Former senator Jarasch said her formal access request will take months, and called the information policy “disastrous” (our translation).

For scale, and only for scale: IBM’s 2026 Cost of a Data Breach report puts the global average cost of a breach at $4.99 million. That figure comes from companies, not public bodies, and it is not an estimate for Berlin. One more number sits uncomfortably close to the cut: the ransom demand, about two million euros, was roughly the size of the 2025 intrusion detection cut. That is a coincidence of size, not a bill, and it is no argument for paying: a ransom does not take back data that criminals have already copied.

What this means for public bodies and companies

• Coverage is the metric. Ask what share of laptops and servers runs detection today, not whether a tool was bought. Servers that hold shared drives come first.
• Someone has to read the alarms. A sensor without people or a service watching it around the clock is a logbook. Tagesspiegel’s criticism of split responsibility applies to many groups of companies too.
• Log what attackers use. CISA recommends detailed PowerShell logging kept for at least 180 days, plus monitoring that shows movement inside the network.
• Segment. Network segmentation limits how far an attacker gets from one PC.
• Keep backups offline and immutable. The BSI says attackers in this campaign scout backup systems before they strike.
• Store less. Many leaked files were ID copies and HR records in shared folders. Delete what you no longer need.
• Train for the fake CAPTCHA. No real CAPTCHA asks you to paste a command into your computer.
• Budget like an insurer. The cost of seeing is known and small next to an incident whose cost no one can total.

What this means for citizens and users

The Senate and Berlin’s data protection commissioner give this advice (summarized, our translation):

• Be careful with emails, texts or calls that claim to come from Senate departments or other authorities, especially unsolicited offers to check whether you are affected or to delete data from the dark web. Verify through official contact details.
• Change passwords, above all for administration and online services, and turn on two-factor authentication.
• Check bank and credit card statements. To block cards, online banking or e-ID, call the German blocking hotline 116 116.
• If your data is misused, report it to the Berlin police (online police station or any local station). Never pay extortionists.
• You can ask the departments which data they hold about you: datenschutzvorfall@senstadt.berlin.de or datenschutzvorfall@senmvku.berlin.de. Other questions: cyberangriff@senatskanzlei.berlin.de.

Do not go looking for the leaked files yourself. Leak sites are run by criminals, and downloading stolen data can put you at legal and technical risk.

What we know and what we don’t

• Confirmed by official sources: the attack, the period of outflow, the refusal to pay, the publication on 4 September, the official advice, the Senate’s refusal to give detection figures in parliament.
• From original reporting with official answers: the five percent and the financial reasons (urban development department to rbb24), the uncovered entry PC and servers (rbb24), the ID copy of Senator Bonde (rbb24, confirmed by her department).
• Reported, not verified by me: contents of the leak (rbb24, Tagesspiegel, CCC); the budget figures (netzpolitik.org, Tagesspiegel).
• Not established: how exactly the attackers got in, whether the €2 million cut caused the five percent, whether BSI warnings reached the departments, and what the incident cost in total.

Sources

• Berlin Senate Chancellery, Cyberattack on the state network: information for citizens, accessed 1 Nov 2026
• Abgeordnetenhaus Berlin, Drucksache 19/27250, written question by Stefan Ziller and Senate answer of 21 Oct 2026
• Berlin Commissioner for Data Protection and Freedom of Information, Cyberattack on the Berlin state network, status 11 Sep 2026
• BSI, BITS-B 2026-287419-1032: German institutions compromised via TerminalFix campaign, 4 Sep 2026
• Microsoft Security, TerminalFix campaign deploys a reverse tunnel through multistage intrusion, 28 Aug 2026
• FBI, CISA, MS-ISAC, #StopRansomware: Rhysida Ransomware (AA23-319A), updated 30 Apr 2025
• rbb24 Recherche, ID copy of transport senator Bonde published on the dark web, 21 Oct 2026
• rbb24, Hacker group publishes data after attack on Berlin state network, 4 Sep 2026; Questions and answers, 8 Sep 2026; IT expert: overview will take weeks, 7 Sep 2026; Senate Chancellery sees acute danger averted, 15 Oct 2026
• taz, Hacker attack on Berlin administration: ID copy of Ute Bonde surfaces on the dark web, 21 Oct 2026
• Tagesspiegel, Security gaps known for years, 19 Aug 2026 (commentary); The data leak was an attack, the Senate’s reaction a scandal, 5 Sep 2026 (commentary)
• netzpolitik.org, Berlin budget 2025: IT security and administrative digitalization under the knife, November 2024
• IBM and Ponemon Institute, Cost of a Data Breach Report 2026

Related on Thorsten Meyer AI

• It’s worse than we thought: AI has taken the clock off cyberattacks. What companies and users should do now
• One hacker, a swarm of AI agents, 100+ company websites: what changes when a break-in costs less
• This week in security: firewall fixes, a rented banking trojan, a blank PDF and stolen tokens
• Europe’s governments are letting AI in