Berlin's Senate Chancellery has confirmed that two state ministries were isolated from the city-state's government network, the Landesnetz, after forensic work uncovered what officials described as an "Inkriminierung des Landesnetzes," a compromise of the state network itself. The affected bodies are the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment. Both were disconnected on Friday, which time.news, citing Spiegel, dates to 14 August 2026, and remained cut off when the Chancellery went public on Monday. Public broadcaster rbb reports, citing sources inside the administration, that "in part very sensitive data" was exfiltrated. The Chancellery itself will confirm only that investigations are ongoing. A crisis team has been stood up, there is no attribution, and no one has said when the intrusion actually began.
What Happened
The public timeline is thin by design. Per the Senate Chancellery statement relayed by The Record and dpa, the two departments were severed from the Landesnetz on Friday "for security reasons" to prevent further damage. rbb notes an important ambiguity that officials have not resolved: it is unclear whether the attack occurred on Friday or was merely detected that day. The breach surfaced through forensic examination rather than through a ransom note or an outage, which is consistent with a quiet intrusion discovered after the fact.
Berlin's Chief Digital Officer, Florian Hauer, is working on the assumption of an external attack, according to rbb. Senate spokesperson Christine Richter has said investigators are still determining whether other administrations are affected, so the two-department scope should be treated as provisional rather than final. Some wire pickups, including Tempo's Antara-sourced report, headline "several ministries," but every account with a body count names the same two.
Operationally, both departments have been fully cut off from the internet since Friday evening. External email is dead. Remote work has been suspended. Staff are communicating by telephone, SMS and fax. The knock-on effects reach citizens directly: The Record reports that applications for housing benefit (Wohngeld) and education and participation assistance cannot be processed at some district offices because those workflows depend on systems run by the urban development department. Tagesschau, drawing on rbb reporting and a notice posted by the Pankow district office, goes further, saying the isolation puts the actual disbursement of housing benefit to more than 50,000 eligible Berlin households at risk. Richter said the administration is working urgently on a workaround.
What Was Taken
This is the single most consequential open question, and the sourcing on it is uneven.
rbb reports, on the basis of government sources, that sensitive data flowed out, characterised by those sources as "in part very sensitive data." No detail has been published on what categories of information were involved, how much, or from which department. The Senate Chancellery has not confirmed exfiltration. Asked directly about a data outflow, it answered only that "the investigations are still ongoing," and the crisis team has cited investigative tactics as the reason for withholding specifics.
So the honest position: exfiltration is reported by German public broadcasting from named-institution sources and echoed by downstream outlets, but it is not officially confirmed, and there is no volume figure, no record count and no data-type breakdown anywhere in the available reporting. Given the departments involved, the plausible exposure surface includes building and planning files, housing benefit case data on tens of thousands of households, transport and environmental administrative records, and internal government correspondence. That is inference from the victim's function, not from any source, and defenders should treat it as such.
Where Accounts Differ
Several factual disputes are live, and papering over them would misrepresent the state of knowledge.
On who owned the vulnerable system, the sources directly contradict each other. rbb reports that attackers exploited a weakness in the IT operations of the urban development department, and states explicitly that the state-owned IT provider ITDZ Berlin was not responsible for the gap. The Record, relaying rbb, adds that ITDZ was not affected and that the two departments share some infrastructure and run their slice of the state network independently of ITDZ. Against this, time.news runs the opposite framing, describing the vulnerable IT operation as managed by ITDZ and citing an unnamed source saying ITDZ is responsible for the gap. Weighting the broadcaster that originated the reporting and the established security outlet that carried it, the better-supported account is that the flaw sat in the ministry's own independently operated IT, not in ITDZ's. Treat the ITDZ-blame version as a single low-tier claim.
On whether the ministries can still function, accounts split even within German reporting. The Senate Chancellery says the administrations remain able to work; building department spokesperson Martin Pallgen told dpa that internal email still functions and the department remains reachable by phone, though staff must be physically on site and inter-department communication is still being organised. An employee of the transport department told Tagesspiegel the opposite: "we are practically unable to work." rbb's later reporting, carried by Tagesschau, sides with the staff account, stating both departments are still not able to work.
On the postal-vote portal, ahead of the 20 September Abgeordnetenhaus election, the accounts also conflict. The Senate's interior administration told dpa that problems with the online application portal for postal ballot documents are not connected to the attack, and that the responsible Landesamt für Bürger- und Ordnungsangelegenheiten is working flat out to fix them. Tagesschau, citing rbb, says the outage is a consequence of the attack, indirectly: the large-scale security analyses running across the network are consuming so much capacity that other systems have hit performance problems. Both can be partially true, but the official line and the broadcaster's line are not the same claim.
One further caveat on sourcing. The aggregator Undercode News packages this incident together with an unrelated advisory about the WordPress Forminator Forms plugin, whose version 1.56.2, released 30 July 2026, fixed an arbitrary file upload flaw across a base of more than 600,000 active installations. Nothing in any source connects that plugin to the Berlin intrusion. They are two separate stories in one article, and the juxtaposition should not be read as an initial access vector.
Why It Matters
A state government network in a G7 capital was compromised through a departmental IT estate, and the containment response was to physically sever two ministries from the shared network for days. That is the tell. When the only reliable way to stop lateral movement is to unplug entire departments, it means the network trusted itself too much and segmentation could not be enforced at a finer granularity.
The federated model here is the structural lesson. Berlin runs a central state IT provider, ITDZ, but these two departments operate their own portion of the Landesnetz independently and share infrastructure with each other. That arrangement means the security posture of the whole network is set by its weakest independently administered node, and it means shared infrastructure carried the blast radius from one department into a second. Any organisation with semi-autonomous business units on a common backbone, whether that is a federal agency, a university system, a hospital group or a holding company, is running the same design.
The civic impact is the other half of the story. Housing benefit for more than 50,000 households is in question, benefit and education assistance applications are stalled at district offices, and there is a live public dispute about whether an election services portal is degraded because of the response. An incident that took no systems down by force still produced days of service failure purely through defensive isolation, five weeks out from a state election. That is a resilience gap, not just a security one.
Finally, note the detection path. This was found in forensic examination, not by a ransomware banner. Nobody has said how long the attackers were resident. Absent a public dwell-time figure, the prudent assumption for anyone modelling this is weeks, not hours.
The Attack Technique
What is known is limited and mostly single-thread. rbb reports that attackers apparently exploited a vulnerability in the IT operations of the urban development, building and housing department in order to attack the Landesnetz, and The Record carries the same claim attributed to rbb and government sources. No CVE has been named, no product or appliance has been identified, and no exploitation timeline has been published.
Berlin's CDO believes the attack came from outside. There is no ransomware claim, no extortion demand, no leak-site posting and no threat actor named by anyone. Officials have declined to discuss scope or background, citing the investigation. Anyone circulating a specific actor name or initial access vector for this incident right now is running ahead of the evidence.
The one piece of structure worth extracting: the reported path runs from a vulnerability in one department's own IT operation into the shared state network. That is an edge-to-core progression through an internally trusted boundary, and it is the pattern to hunt for regardless of which specific flaw turns out to have been used.
What Organizations Should Do
- Audit every independently administered node on your shared network. Inventory which business units, agencies or subsidiaries run their own IT operations while connecting to a common backbone, and confirm each one meets the same patching, logging and hardening baseline as the core. Berlin's reported vector was one department's own IT estate, not the central provider.
- Prove you can segment without unplugging. Test whether you can isolate a compromised business unit at the network layer while preserving its email, internet and case-processing workflows. If your only containment move is a full disconnect, you will inherit Berlin's outcome: staff on fax machines and citizen services frozen.
- Map service dependencies across the trust boundary. District offices lost the ability to process housing benefit because the workflow lived on a system owned by another department. Identify which of your critical processes depend on infrastructure you neither own nor administer, and pre-plan a manual or alternate path for each.
- Hunt for edge-to-core lateral movement now. Review authentication, east-west traffic and privileged access logs between semi-autonomous units and shared services for the past 90 days at minimum. The Berlin intrusion surfaced in forensics, which means it survived normal monitoring for an unknown period.
- Capacity-plan your incident response. Tagesschau's reporting that large-scale security scanning starved other services of network capacity is a real and underrated failure mode. Confirm your forensic and EDR sweep tooling can run at full tilt without degrading citizen-facing or revenue-facing systems, and rate-limit it if it cannot.
- Prepare exfiltration disclosure ahead of confirmation. Berlin's official line remains "investigations are ongoing" while its own public broadcaster reports sensitive data left the building. That gap corrodes public trust. Decide in advance what you will say, to whom, and on what evidentiary threshold, including your GDPR Article 33 and 34 clocks.
- Treat unpatched internet-facing web components as in scope. No source links the Forminator plugin flaw to this incident, but the general lesson stands on its own: version 1.56.2 of that plugin, shipped 30 July 2026, fixed an arbitrary file upload issue across 600,000-plus installations. Inventory and patch your public web estate.
Sources: Berlin cuts two state ministries off government network after secur... | Hackerangriff - Was der Cyberangriff auf die Berliner Verwaltung be... | Cyberattack hits Berlin state ministries | Berlin Govt Network Breached, Several Ministries Cut Off - ASEAN &... | https://time.news/berlin-hacker-attack-leaves-departments-isolated-... | Offenbar Hackerangriff auf Berliner Landesnetz verübt | Berlin: Berliner IT-Systeme nach Hackerangriff teilweise eingeschrä... | Berlin Government Offices Hit by Cyberattack as WordPress Forminato...