Berlin's state network was compromised on 14 August and both isolated Senate departments came back online on 23 August — nine days in which housing benefit stopped for more than 50,000 households and no named authority stated how the attackers got in

This is the week's clearest example of an incident that a technical intelligence pipeline cannot publish operationally and a reader nonetheless needs to know about. This pipeline surfaced Berlin's Landesnetz compromise on 20 August, re-worked it with a scoped deep read on 23 August, and could not publish either time — because an entry describing attacker activity has to describe attacker activity, and after nine days there is none on the public record. What there is instead is a complete account of the consequences of isolating two ministries from a shared state network, and that is the part with a transferable lesson for any administration built the same way.

The Senate Chancellery's own release of 17 August states the finding in one sentence — "Im Zuge forensischer Untersuchungen hat sich eine Inkriminierung des Landesnetzes Berlin ergeben," forensic investigations having established a contamination of the Berlin state network — and records that the Landeskriminalamt, the Berlin public prosecutor and the Bundesamt für Sicherheit in der Informationstechnik were all involved, with an ICT emergency crisis team under the state's information-security commissioner stood up that day. The two affected administrations, the Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment, had been separated from the Landesnetz since the preceding Friday, 14 August, as a precaution. The release closes the door on the question every defender asks next: "Aus ermittlungstaktischen Gründen können derzeit keine weiteren konkreten Informationen zu Ausmaß und Hintergründen gegeben werden" — for investigative reasons no further concrete information on scope or background can currently be given (Senatskanzlei, 2026-08-17).

What the isolation actually cost is the strategic content. At a press conference on 19 August the Governing Mayor said Berlin had been the victim of a hacker attack, that the incident was serious, and that on current knowledge no sensitive data had flowed out; the Interior Senator said the state election of 20 September was not endangered by the attack. The two administrations were reachable only by telephone, and services around housing benefit — both application and disbursement — were unavailable (Berlin.de (dpa/BerlinOnline), 2026-08-19). Note where that failure lands: not in the two ministries that were isolated, but in the district offices whose citizen-facing processes run on applications those ministries host. Tagesspiegel puts the population figure on it — disbursement of housing benefit to more than 50,000 entitled households was not possible (Der Tagesspiegel, 2026-08-23). Berlin.de's English news item of 23 August adds that the disruption also reached benefits under the education and participation package for children and adolescents (Berlin.de (dpa), 2026-08-23).

Nine days later the Governing Mayor announced that "All Senate departments are once again connected to Berlin’s state network and are, in principle, operational," with the Senate Chancellery noting that the specialised procedures used in the districts are in principle available again and that occasional disruptions and delays may persist at the outset; both administrations have implemented immediate measures including continuously increased monitoring of their IT systems, and the forensic work continues in the coming weeks (Berlin.de (dpa), 2026-08-23).