Loading story…
Berlin authorities disconnected two state ministries from the city government network after detecting a cybersecurity breach affecting the ministries for urban development, construction and housing, and for mobility, transport, climate protection and the environment. Officials isolated the ministries as a precaution while investigators examined reports that attackers may have exploited a vulnerability in one ministry’s IT systems; German media also reported that data was exfiltrated. Authorities have not publicly identified the threat actor, disclosed the intrusion timeline, or confirmed the full scope of the compromise.
The incident left parts of the ministries effectively unable to work, with staff reportedly cut off from email and internet access and relying on phone, SMS, and fax for communication. The disruption also affected public services, including processing of housing benefits and education-related assistance at some district offices. Berlin’s central IT service provider, ITDZ Berlin, was reportedly not impacted because the affected ministries operated their portion of the state network independently, though they shared some infrastructure with each other.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Berlin officials said the cyberattack was discovered on 14 August, after which the Senate administrations for urban development and transport were disconnected from the internet. Officials later described the intrusion as highly professional and began broader network scanning and investigation.
Berlin's Senate Chancellery said sensitive personal or other non-public data may have been exfiltrated in the attack, potentially affecting the Senate Department for Mobility, Transport, Climate Protection and the Environment. Authorities said the scope and content remain under review, while forensic work and network scanning continue.
Berlin officials said all Senate administrations had been reconnected to the Berlin state network and were fundamentally operational again after the cyberattack. Authorities said specialist procedures in the districts were largely available again, while warning that some isolated impairments and delays could continue during recovery.
Berlin authorities said forensic investigations found a compromise of the Berlin regional network following the cyberattack on two Senate administrations. The Senate Chancellery also set up a crisis cell to coordinate the incident response.
The disruption caused by the cyberattack prevented payment of housing benefits to more than 50,000 eligible households in Berlin. The incident also continued to affect the 'Bildung und Teilhabe' support program for children and young people.
The network isolation left employees at the affected ministries without normal email and internet access, forcing them to use telephone, SMS, and fax. The incident also interrupted some district-office services, including processing of housing assistance and education-related benefit applications tied to the urban development ministry's systems.
Berlin authorities disconnected the ministries for urban development and for mobility from the city government's IT network as a precaution after discovering the security breach. The Senate Chancellery said the two ministries had been isolated since Friday to protect the wider state network.
Government sources cited by RBB said attackers allegedly exploited a vulnerability in the IT systems of one of the two affected Berlin state ministries, leading to the breach. The exact intrusion date, threat actor, and full access details were not disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
9 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourceheise.de
Open sourceheise.de
Open sourceheise.de
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcetherecord.media
Open sourcetagesspiegel.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The city administration of Ludwigshafen experienced a significant IT outage, with all online services, telephone, and email communications rendered unavailable for several days. Initial investigations and monitoring system alerts prompted the city to disconnect its IT systems on November 6, and a forensic analysis was immediately launched. Authorities have since confirmed that indications of a cyberattack have strengthened, though there is currently no evidence of citizen data exfiltration. Emergency protocols were activated, and the city continues to assess the extent of the incident while working to restore services. This incident highlights the ongoing threat to public sector organizations in Germany, as noted in recent reports by the Federal Office for Information Security (BSI), which warns that cyberespionage and attacks on public administration remain a serious concern. The BSI also emphasizes that many institutions, particularly those with political relevance, remain vulnerable due to insufficient security measures. The Ludwigshafen case underscores the need for robust cybersecurity and incident response capabilities in municipal administrations.
Jul 12, 2026
Germany’s Dresden State Art Collections (**SKD**) reported a targeted cyberattack that disrupted large parts of its digital infrastructure, leaving online ticketing, visitor services, and the museum shop unavailable and forcing on-site payments to cash-only. The museums remained open, and Saxony’s culture ministry said security systems protecting the collections were not affected; the attacker, motive, and whether a ransom demand was involved were not disclosed, and full restoration timelines were unclear. Separately, multiple German organizations reported **ransomware** incidents causing service outages. The Verkehrsgesellschaft Main-Tauber (**VGMT**) said attackers encrypted its servers and data, forcing closure of its office and mobility center and cutting phone/email availability; it remains unclear whether data was stolen. Regensburg-based IT service provider **Conceptnet** said threat actors gained access around 13 January 2026 and encrypted core systems including web and email servers, disrupting websites for customers (including REWAG, Stadtwerk Regensburg, and SSV Jahn Regensburg) while external forensics and recovery efforts continue and temporary websites have been stood up to maintain limited customer presence online.
Jun 29, 2026
Germany’s federal government signaled a shift toward a more **offensive posture** in response to cyberattacks. Interior Minister **Alexander Dobrindt** said Germany intends to “strike back,” including actions abroad to disrupt attackers and destroy their infrastructure, with operations to be carried out jointly by intelligence services and the **Bundeskriminalamt (BKA)**. The Interior Ministry also plans a new defense center for **hybrid threats**, prepared by the domestic intelligence service, to improve coordination across government levels; Dobrindt framed the move as a response to persistent attacks on institutions, critical infrastructure, and companies, often attributed to groups linked to state services (including Russia). Separately, the **Staatliche Kunstsammlungen Dresden** (a network of 15 museums) reported continued operational impacts from a **cyberattack**, with museums remaining open but key services still impaired, including `online ticketing`, card payments on-site, the online shop, and visitor services. Police and the state criminal office initiated investigations, and the Dresden public prosecutor indicated the case may be handled by Saxony’s specialized cybercrime unit (ZCS). The UK government’s discussion of building a **digital ID** system in-house is policy/technology governance reporting and does not describe a specific cyber incident or vulnerability tied to the German developments.
Jul 12, 2026