🔍 Read the full analysis: What Was The Real Cost Of Berlin’s Limited Attack Detection? on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A 2026 ransomware attack on two Berlin government departments led to the theft and online publication of about 1.4 million files. An rbb24 investigation found that the attack-detection software in the urban development department was licensed for only 5% of devices, excluding the computer identified as the entry point and the servers involved in the data transfer. The precise financial cost of the limited coverage, and whether earlier budget cuts caused it, have not been established.
Berlin’s 2026 ransomware breach exposed about 1.4 million files, and an rbb24 investigation published October 21 found that the attack-detection system in the Senate Department for Urban Development, Building and Housing had licenses for just 5% of its devices. The department told rbb24 that wider coverage was not possible “for financial reasons”; the computer identified as the attackers’ entry point and the servers from which data left were not covered.
The attack affected the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment. According to the Berlin Senate and rbb24, most of the data was taken between August 7 and 12. The administration detected the incident on August 14, isolated both departments from the state network and made the attack public three days later. The state said there was no further attack on its network after August 13.
The ransomware group Rhysida demanded 30 bitcoin, which Berlin officials said was worth about €2 million at the time. Berlin refused to pay. On September 4, the group published the stolen files online. Reporting by rbb24 and Tagesspiegel described roughly 1.4 million files, including personnel records, scanned identity documents, payslips, contracts and information about building projects. The Senate has said the files were mostly unstructured material from employees’ shared and personal directories, rather than specialist applications.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The Senate has also said it expects data belonging to citizens and companies to be included, but the scale and identities of those affected have not been fully established.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
The Cost of Partial Coverage
The confirmed consequence is not just a gap in a technical inventory: the uncovered systems included the reported entry-point computer and the servers involved in the data leaving the network. That means the system Berlin had introduced to detect attacks was not positioned to monitor the devices central to this breach. The source material does not establish that broader coverage would have stopped the intrusion or prevented the leak, but it identifies a concrete limitation in the detection setup during the attack.
For affected people, the published material creates risks beyond the initial outage. Identity documents, employment details and other personal records can be used in tailored scam messages or attempts at impersonation. The leak also included information connected to public projects and critical infrastructure, according to rbb24’s reporting. Berlin has advised people to check suspicious messages carefully, change passwords, use two-factor login, monitor bank statements and report misuse to police.
The financial question remains broader than the cost of software licenses. The supplied reporting gives no verified total for recovery, public-service disruption, notification work, or harm to people whose information appeared online. It also does not quantify what a fully licensed detection system would have cost or prove that it would have changed the outcome. The known figures show the coverage gap and the scale of the leak, not a complete accounting of the attack’s price.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Warnings Before the August Breach
The detection system was introduced in 2026, but the urban development department told rbb24 that licenses covered only one device in twenty. It said expanding coverage to all devices was not possible “for financial reasons,” translated from the department’s statement. The source material does not specify the total number of devices, the license price, or whether the same coverage limit applied to the other affected department.
There had been earlier signs of pressure on Berlin’s IT security resources. In 2024, the two departments told rbb that funding for necessary IT security measures was available only partly to the required extent. Reporting by netzpolitik.org in November 2024 said Berlin’s 2025 budget reduced intrusion-detection funding by €2 million and cut the IT service center’s budget line from €32.2 million to €18.2 million. Those budget changes are documented, but a direct link between them and the five-percent license coverage has not been established.
Berlin’s information-security guideline has required authorities since 2017 to provide sufficient staffing and funding for protection, according to the supplied reporting. An internal 2023 security report, seen by rbb, had also called for expanding systems to detect and defend against cyberattacks earlier. These records provide context for the later coverage limitation; they do not, on their own, establish who made the licensing decision or what alternatives were considered.
What the Cost Figures Leave Out
The available reporting does not give a full financial estimate of the breach. It is unclear how much Berlin spent on response and recovery, how much disruption to services cost, or what expense wider detection coverage would have required. The stated €2 million figure describes the ransom demand, not the total cost of the incident.
It is also not established that the 2025 budget reductions caused the five-percent coverage level, or that broader licensing would have detected the attackers in time to prevent data theft. The supplied material does not identify the precise number of exposed individuals, provide a complete inventory of published files, or establish how many citizens and companies were affected. Officials’ expectation that their data may be included is not a count of confirmed victims.
How Berlin Accounts for the Breach
The next reporting and official updates will need to clarify which people and organizations have been identified in the leaked records, what steps Berlin has taken to secure or replace exposed credentials, and whether the city has expanded monitoring to devices that were outside the system’s coverage. The supplied source material does not give a date for a final audit or a completed public accounting of the incident.
For people who may be affected, Berlin’s stated advice is to treat messages claiming to come from authorities with care, change passwords, enable two-factor login, watch bank statements and report suspected misuse to police. Those steps can reduce some risks, but they cannot remove information already published. The relationship between budget decisions and the limited coverage remains a key unanswered question.
Key Questions
What was the real cost of Berlin’s limited attack detection?
No complete total has been reported in the supplied material. It documents a 30-bitcoin ransom demand, roughly 1.4 million files published, and a detection system that covered only 5% of devices in one department, but it does not calculate recovery, service-disruption or personal costs.
When did Berlin’s departments detect the attack?
The Berlin administration detected the incident on August 14, 2026. The Senate said most data had left between August 7 and 12.
What information appeared in the leak?
Reporting described personnel files, scanned identity documents, payslips, contracts and building-project information. rbb24 also reported finding Transport Senator Ute Bonde’s ID copy and stored digital signature; her department confirmed she was affected.
Did Berlin’s budget cuts cause the detection gap?
That has not been established. Earlier reporting documented reductions in Berlin’s 2025 intrusion-detection and IT service-center budgets, but the available material does not prove those cuts caused the five-percent license coverage.
Source: ThorstenMeyerAI.com
