Germany's investigation into the Berlin Pride attack has shifted from a citywide manhunt to a review of how authorities handled a suspect already tied to ISIS propaganda and a failed attempt to join the group. Police killed Abdul Ballout, 21, at an allotment garden in Spandau after officials said he rushed officers with a knife.

The assault began near Berlin's Christopher Street Day celebration on July 25, 2026, when a rented minivan was driven into people in Tiergarten before the attacker continued on foot with a machete-like weapon. The confirmed toll stood at one death and no fewer than 29 injuries, according to the latest figures cited by CBS News and The Guardian.

Ballout's identification, death and criminal record materially expand the facts available in ETUD's first-hours report, which was published while officers were still searching for the person who had left the van. The new record places the attack after a terrorism-related conviction, a suspended prison sentence and a police search at his home three and a half weeks earlier.

Police said the confrontation that ended the search occurred at a garden colony in western Berlin. Ballout was shot after advancing on officers with a knife and died at the scene. Investigators are still determining whether he acted alone. Another man was detained after the attack, but police had not established that he took part.

A Suspended Sentence Followed an ISIS Case

The prosecutor's timeline starts in 2024, when Ballout circulated ISIS material through his Instagram account. The following year, he traveled to Lebanon with the intention of reaching Syria and joining the group, according to the account given to CBS News. After his arrest abroad, a three-month term preceded his return to Germany in November 2025.

German authorities arrested him again in May over preparations for a serious act of subversive violence. The resulting sentence of one year and 10 months was suspended. Prosecutors said the court credited detention already served in Lebanon and before trial, while also taking account of his admissions and his stated decision to distance himself from ISIS.

That history was not the last contact before the Pride attack. A separate encounter came on July 3, when officers entered Ballout's Schöneberg residence while examining a possible breach of Germany's Weapons Act. They recovered only a toy gun and closed the matter without a charge. The search produced no weapons case, but its timing now makes it a central point in the reconstruction of the weeks before the assault.

Interior Minister Alexander Dobrindt described Ballout as someone known for criminal conduct, radicalization and links to the city's Islamist milieu. He urged people attending Pride events not to accept intimidation as the attack's final effect.

“These acts have only one purpose: They aim to divide our society.”

The Attack Combined a Vehicle Strike and a Blade Assault

Police believe Ballout rented the white minivan used in the assault. Shortly before 10 p.m., the vehicle left the road in Tiergarten, hit pedestrians on a path and crashed into a tree. Officials said the attacker then fled on foot and used a blade described as machete-like against others. The sequence forced emergency crews to treat a mass-casualty scene while officers searched the capital.

The fire service placed three victims in critical condition and classified eight more as seriously wounded. The attack took place close to the Brandenburg Gate celebration that was due to close the city's major annual LGBTQ+ gathering. The day's procession had included more than 80 floats alongside 50 groups moving on foot through central Berlin.

Berlin's CSD program added a Friday-night democracy rally this year, a first for the event. Organizers presented Saturday's march as a response to rising hostility toward LGBTQ+ people. The attack therefore struck after a program that had explicitly joined a public celebration to a defense of civic rights.

Hundreds of mourners returned to the Brandenburg Gate on Sunday with flowers, candles and rainbow flags. Chancellor Friedrich Merz ordered the Bundestag flag lowered to half-mast and said Germany would consider consequences while defending its freedom. The political response is developing alongside the criminal inquiry, which must still settle the complete chain of assistance, planning and contact around Ballout.

The debate also follows several German vehicle attacks with different alleged motives. Six people died at a Magdeburg Christmas market in December 2024, a mother and her two-year-old child were killed at a Munich trade-union demonstration two months later, and a March 2025 ramming in Mannheim killed two more people. Those cases do not establish a common cause, but they have increased pressure on the government to show how police, courts and security services assess separate forms of violent risk.

The Case Review Turns on Information That Already Existed

The decisive evidence is no longer limited to the crashed van or the route through Tiergarten. Courts, prosecutors and police had separate records of an attempt to join ISIS, a terrorism-related conviction, a suspended sentence and a July 3 weapons search. Investigators now need to establish what information was shared across those encounters, which legal thresholds were considered and whether any later conduct changed the risk assessment.

Germany can tighten surveillance or sentencing rules after the attack, but a policy change will be credible only if it answers the sequence already in the file. If the review cannot explain what changed between the suspended sentence, the July search and the July 25 assault, it will leave the central security failure unmeasured.