A hacker attack on Berlin’s state network has left key departments isolated, with officials withholding details about data loss or the attack’s origin. The Senatsverwaltung for Stadtentwicklung, Bauen und Wohnen and Mobilität, Verkehr, Umwelt und Klimaschutz were cut off from the landesnetz on August 14, 2026, as investigations continue.
The attack on Berlin’s state network, first detected through forensic investigations, has triggered a wide-ranging response from security agencies. Two major departments—the Senatsverwaltung for Stadtentwicklung, Bauen und Wohnen and the Senatsverwaltung for Mobilität, Verkehr, Umwelt und Klimaschutz—were isolated from the landesnetz on August 14 to prevent further damage, according to the Senatskanzlei. Officials have not confirmed whether sensitive data was exfiltrated, with the crisis team citing investigation tactics as the reason for withholding details.
Hacker Exploited ITDZ Vulnerability, Officials Say
Investigators traced the breach to a vulnerability in the IT-Betrieb of the Senatsverwaltung for Stadtentwicklung, Bauen und Wohnen, which is managed by the state-owned ITDZ. A source reported that the ITDZ is responsible for the gap, though the exact nature of the flaw remains unclear. The Senatskanzlei confirmed the attack but declined to elaborate on the timeline, leaving open whether the breach occurred on August 14 or was discovered then.
Berlin: Ausmaß nach Hackerangriff auf Landesnetz unbekannt
The breach has disrupted operations, with employees in the Senatsverkehrsverwaltung reporting that home office work is impossible without internet access. We are practically unable to work without internet and email communication outward,
a staff member told the Tagesspiegel, adding that a solution by the next day is unlikely. Despite the isolation, officials stated the affected departments remain operational through alternative channels.
Crisis Team Coordinates Forensic Probe, Security Agencies Involved
A crisis team led by the Landesbevollmächtigter für Informationssicherheit has been coordinating the response, with the Landeskriminalamt (LKA), Bundesamt für Sicherheit in der Informationstechnik (BSI), and Berlin’s Staatsanwaltschaft all involved. The Staatsanwaltschaft confirmed an official investigation was opened, though no charges have been filed. Out of investigative tactics, no further specific information on the scope and background can currently be provided, the Senat stated, echoing similar language from multiple sources.
The Tagesspiegel and dpa reported that data may have been compromised, though the Senat has not confirmed this. Senatssprecherin Christine Richter told dpa, The forensic investigations continue,
without specifying the extent of the breach. The lack of transparency has raised concerns among staff, with one employee noting, We are practically unable to work without internet and email communication outward.
Uncertainty Lingers Over Impact and Future Steps
Ausmaß noch unbekannt
As of August 18, 2026, the full scope of the attack remains unknown. The Senat has not disclosed whether the breach originated domestically or abroad, nor has it provided a timeline for restoring full network access. The involvement of the BSI and LKA suggests the incident is being treated as a high-priority cyber threat, though no public updates have been released.
The attack adds to Berlin’s history of cyber incidents, including the 2015 Bundestag breach and the 2021 Ransomware attack on Anhalt-Bitterfeld. However, the current case is distinct in its focus on local government infrastructure. With no official statement on the attack’s origin or potential long-term consequences, the situation remains in flux, leaving affected departments and staff in limbo.
Previous Cyberattacks in Germany Highlight Growing Threats
Source 4 details five major hacker attacks in Germany, including the 2015 Bundestag breach, where attackers stole 16 gigabytes of data and were linked to the Russian group APT28. The 2016 Telekom Router attack disrupted one million DSL routers, while the 2016–2018 Regierungsnetz breach compromised the Informationsverbund Berlin-Bonn, a communication network for federal ministries. The 2021 Ransomware attack on Anhalt-Bitterfeld led to the first Cyber-Katastrophenfall in Germany, halting 160 applications. The 2021 DDoS attacks on the Finanz-IT affected 820 Volks- und Raiffeisenbanken, restricting online banking services.
Officials and Agencies Involved in Response
Hackerangriff auf Berliner Landesnetz
The Landeskriminalamt (LKA), Berlin’s Staatsanwaltschaft, and the Bundesamt für Sicherheit in der Informationstechnik (BSI) are actively investigating the breach. A Staatsanwaltschaft spokesperson confirmed the initiation of an official investigation. The crisis team, under the Landesbevollmächtigter für Informationssicherheit, is managing the further security measures and the ongoing forensic investigations,
as stated by the Senatskanzlei. However, the Senat has not provided further details, citing ermittlungstaktischen Gründen.
Employee Reports and Operational Impact
Employees in the Senatsverkehrsverwaltung described severe disruptions, with one stating, Few here believe a solution will be found by tomorrow.
The affected departments remain operational but rely on telephone communication instead of email. The Senatskanzlei emphasized that the isolated departments are “arbeitsfähig,” though the exact extent of operational capabilities remains undisclosed.
Unresolved Questions and Ongoing Investigations
As of the latest reports, it remains unclear whether data was exfiltrated or the origin of the attack. The Senat has not confirmed if the breach was internal or external, nor has it specified the timeline of the incident. The forensic investigations continue, with the Senat maintaining a policy of limited disclosure to avoid compromising the probe.
