🔍 Read the full analysis: The Role Of AI In Understanding Rhysida’s Berlin Attack on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Berlin’s 2026 Rhysida ransomware attack went undetected while attackers copied data from two Senate departments, according to the Senate and German media reports. An rbb24 investigation found the detection system covered licenses for only 5% of devices in one department, excluding the identified entry PC and the servers involved in the data transfer. The supplied reporting does not establish that AI played a role in detecting, investigating or preventing the attack.
Rhysida stole data from two Berlin Senate departments during an August 2026 ransomware attack, and an October rbb24 investigation found that the attack-detection system in one department had licenses for only 5% of its devices. The reported gap matters because neither the PC identified as the attackers’ entry point nor the servers from which data was copied were covered. The source material does not report that AI detected or analyzed the incident; it instead points to limited coverage of the detection system.
The Berlin Senate says most of the data left the network between August 7 and August 12, and that the attack was noticed on August 14. The affected bodies were the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. They were disconnected from the state network as a precaution, and some services were limited while staff worked by phone, rbb24 reported.
Berlin did not pay the 30-bitcoin ransom demand, which the Senate Chancellery valued at about two million euros. Rhysida published the stolen material on September 4. Reports put the leak at about 1.4 million files, including personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate described the material as mostly unstructured data from employees’ shared and personal directories; it expects information about citizens and companies may also be affected.
In October, rbb24 reported finding a copy of Transport Senator Ute Bonde’s identity card and a stored copy of her digital signature in the leak. Bonde’s department confirmed she was affected. The reporting also described emails belonging to her predecessors and other sensitive records. These are findings about material in the published files, not evidence that every record or person in the leak has been identified.
Infographic 01 · How it unfolded
Warned, under-funded, then a week of silence
From the plan to watch the network to the files on the dark web: what happened when, according to the Senate, the BSI and the reporting.
- 2023Plan to expand detectionInformation security report: expand systems “to detect and defend against cyberattacks” (seen by rbb24).
- Nov 2024Budget 2025 cutState IT line €32.2M → €18.2M; €2M cut from intrusion detection (netzpolitik.org).
- From Mar 2025BSI warns about ClickFixFake CAPTCHA attacks, repeatedly, also in daily reports to the states (BSI via rbb24).
- 2026Detection rolled out, partlyLicenses for 5% of all devices; more not possible “for financial reasons” (our translation).
- 7–12 Aug 2026Data leaves the networkMain outflow period (Senate). Entry PC and servers were not covered by detection (rbb24).
- 14 AugAttack noticedTwo departments cut off from the state network; citizen services limited. Public three days later.
- Late AugExtortionRhysida demands 30 bitcoin, about €2 million. The Senate refuses.
- 4 SepFiles publishedRhysida posts the data. Same day: BSI advisory on a compromised state institution (TerminalFix).
- 15 Oct“Acute danger” overSenate Chancellery: no attacks on the examined network areas since 13 August.
- 21 OctFive percent revealedrbb24: senator Bonde's ID copy in the leak. Same day, the Senate tells parliament it will not give detection figures.
Dates as given by the sources. “Late August”: rbb24 reported on 4 September that the mayor had confirmed the extortion the week before.
Sources: Berlin Senate information page, Drucksache 19/27250, BSI advisory, 4 Sep 2026, rbb24 Recherche, 21 Oct 2026, rbb24, 4 Sep 2026, rbb24 Q&A, 8 Sep 2026, rbb24, 15 Oct 2026, netzpolitik.org, Nov 2024. Translations by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Detection Coverage Matters
The reported 5% coverage figure shifts attention from the mere presence of security software to which devices it can actually monitor. According to rbb24, the entry PC and the servers involved in the data outflow were outside the licensed portion. A detection product cannot alert on activity from devices it does not cover, so a partial deployment can leave important parts of a network unseen. The supplied account does not establish whether broader coverage alone would have stopped the attack.
The incident also shows how a cyberattack can affect people beyond government staff. Leaked identity documents and employment records can expose individuals to impersonation and targeted scams, while building and infrastructure information may carry wider security implications. The Senate said the stolen files were at most at the lowest of four classification levels, but that classification does not mean the material is harmless to those named in it.
For readers, the practical concern is that criminals may use details from leaked records to make messages appear credible. The source advises checking communications that claim to come from authorities, changing passwords, enabling two-factor login, monitoring bank statements and reporting suspected misuse to police. Those steps reduce exposure but cannot establish whether a particular person’s data was taken.
Popular right now
Shark Clean & Empty Cordless Stick Vacuum with Auto-Empty System, BU3521
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Berlin Leak Unfolded
Berlin’s administration identified the intrusion on August 14, 2026, after the Senate says most data had already been copied. The state made the incident public three days later. The departments were isolated from the network while officials responded, and Governing Mayor Kai Wegner later confirmed the city was being blackmailed. The ransom demand and Berlin’s refusal were reported by the Senate Chancellery.
The detection gap emerged from a later rbb24 investigation. The urban development department told the broadcaster that its attack-detection system, introduced in 2026, had licenses for only 5% of all devices; expansion was not possible “for financial reasons,” according to the report’s translation. The department’s reported explanation concerns that system’s coverage. It does not establish that budget choices caused the intrusion or that a fully licensed deployment would have prevented it.
There was earlier budget pressure: netzpolitik.org reported in November 2024 that Berlin’s 2025 budget cut €2 million from intrusion detection and reduced the IT service center’s budget line from €32.2 million to €18.2 million. The available reporting does not connect those particular cuts directly to the five-percent license coverage. That distinction matters: the figures provide financial context, but they do not prove a causal link.
The topic framing refers to AI, but the supplied reporting identifies no AI system used in the attack response and no AI analysis that uncovered the coverage gap. The news development is about cyberattack detection and device coverage. AI may be a broader subject in cybersecurity, but claims about its role in this Berlin incident would go beyond the evidence provided.
What the Evidence Does Not Establish
Several important details remain unresolved in the supplied reporting. Authorities have not publicly established the full list of people and organizations whose information was taken, or the precise number of affected individuals. While the Senate expects citizen and company data to be included, the extent of that exposure is still unclear.
The reporting also does not establish how the attackers gained initial access, whether any other security controls detected activity, or whether broader detection coverage would have stopped the data theft. The department’s financial explanation is reported, but a direct causal link between Berlin’s earlier budget reductions and the limited licenses has not been shown.
There is likewise no sourced evidence here that AI played a role in identifying the intrusion, analyzing the stolen files or guiding Berlin’s response. Nor does the material specify how many downloaded copies remain in circulation, whether the attackers have used the data further, or what remediation has been completed for all people whose records may be exposed.
What Berlin Must Clarify
The next updates to watch for are findings from Berlin’s continuing review of the incident: a clearer account of affected records and people, the route the attackers used, and what steps have been taken to close gaps in monitoring. The supplied source does not give a date for a final investigation report or identify a specific future release.
Residents and employees who may be affected should follow official notices and use the advice reported by Berlin’s authorities: verify unexpected messages, change reused or exposed passwords, enable two-factor login, monitor bank statements and report suspected identity misuse to police. Any claim about AI’s contribution to future defenses should be treated separately unless Berlin or an identified technical investigation provides evidence about its use in this case.
Key Questions
What happened in the Berlin Rhysida attack?
Berlin says attackers copied data from two Senate departments, mostly between August 7 and August 12, 2026. The attack was noticed on August 14, and Rhysida published the files on September 4 after Berlin refused to pay.
What does the 5% detection figure mean?
According to an rbb24 investigation, licenses for the detection system covered 5% of devices in the urban development department. The reported entry PC and the servers from which data left were outside that coverage. The figure does not by itself show that broader coverage would have prevented the attack.
Did AI detect or investigate the attack?
The supplied reporting does not say that AI was used to detect, investigate or respond to the incident. It focuses on the limited coverage of Berlin’s attack-detection system, and provides no evidence of an AI role.
What information was exposed?
Reports describe about 1.4 million files, including personnel records, scanned identity documents, payslips, contracts and building-project information. The Senate expects citizen and company data may also be affected, but the full list of exposed people and records is not yet clear.
What should people do if they may be affected?
Follow official notices, verify messages claiming to come from authorities, change passwords, enable two-factor login, monitor bank statements and report suspected misuse to police. The source material does not provide a complete list of affected individuals.
Source: ThorstenMeyerAI.com
