A daily emergency task force is active; there are no definitive signs of ongoing infiltration, but suspicions persist and networks are being scanned and analyzed.

The incident is classified as an ICT incident affecting security, availability, and confidentiality, with restoration efforts underway and cautious optimism for a speedy reconnect, though full restoration may take days.

Internal systems are operational and external connectivity has been restored, with ongoing monitoring for residual threats.

An ongoing investigation has opened with limited information shared for tactical reasons.

Political context includes heightened concerns about hybrid and right-wing extremism ahead of regional elections, with emphasis on unity and civil society support.

As restoration continues, lingering workflow delays and initial disruptions may persist while systems stabilize.

Authorities note ongoing updates to the situation as new information becomes available.

The incident underscores ongoing cyber risk and the need for continuous vigilance in government IT networks.

A cyberattack targeted parts of Berlin's state administration, triggering a formal investigation by authorities.

Hackers threaten to publish stolen data on the dark web within seven days if the ransom is not paid.

Officials insist the upcoming local elections on September 20, 2026 remain secure and unaffected by the incident.

District-level essential departmental systems are largely back online, though some workflows may still experience sporadic disruptions.