Anhalt-Bitterfeld and the first cyber disaster declaration
The cyberattack of 6 July 2021 initially brought Anhalt-Bitterfeld’s district administration to a complete standstill. Effective 9 July, the district declared Germany’s first disaster caused by a cyberattack. Its end on 31 January 2022 did not mean that IT had been fully restored.
Key takeaways
- Anhalt-Bitterfeld declared Germany’s first disaster caused by a cyberattack. It took effect on 9 July 2021 and was intended to give the district broader options for containing the impact.
- Recovery remained incomplete for a long time. Neither the return of individual services from August 2021 nor the end of the disaster on 31 January 2022 meant that IT had been fully restored.
- The district rebuilt its technology and organisation. It says it spent around 2.5 million euros on this and created an information security officer post.
Background at the district administration
Anhalt-Bitterfeld’s district administration was headquartered in Köthen and operated branch offices in Bitterfeld and Zerbst. In summer 2021, all three sites were part of a shared administrative network. The offices provide services that matter to residents, such as vehicle registration, which residents notice immediately when it is unavailable. In July 2021, an attack hit this structure and made the district a precedent for German public administration.
What is double extortion? Double extortion is a tactic used by ransomware groups in which attackers steal data before encrypting it and threaten to publish it. The victim faces twofold pressure: it wants to regain access to its systems and prevent a data leak. Working backups therefore solve only part of the problem.
The attack and timeline
On 6 July 2021, a cyberattack hit the district administration and initially brought it to a complete standstill. It was a ransomware attack. Ransomware is malicious software that encrypts data so attackers can demand a ransom to release it. The encryption affected the administrative network at the Köthen headquarters and the Bitterfeld and Zerbst branch offices.
The group Grief claimed responsibility for the attack. It used double extortion, combining encryption with a threat to publish stolen data.
Effective 9 July 2021, the district declared a disaster. On 31 January 2022, it declared the disaster over. The work was unfinished, however: as of May 2022, the recovery process was expected to continue.
The decision to declare a disaster
The most far-reaching decision came shortly after the attack. The district declared a disaster to gain broader options for responding to or containing its impact. It was Germany’s first disaster caused by a cyberattack.
In parallel, the specialist departments organised emergency operations. After the attack, an emergency network, a provisional IT environment, was set up. By the meeting of 29 July 2021, the departments had drawn up a priority list of services relevant to residents for expanding this network. This established the order in which services for citizens would return.
The third decision concerned the extortionists. The district says it refused to pay the demanded ransom.
Service resumption: outcome and costs
Vehicle registration illustrates the gradual resumption of services. It was available again from 3 August 2021, initially only at the Köthen administrative site and by telephone appointment. The return of individual services did not mean that IT had been fully restored, and neither did the subsequent end of the disaster.
As of March 2024, the district said it had spent around 2.5 million euros as a result of the attack. The money went towards rebuilding infrastructure, data recovery, new servers, storage media, laptops and software.
In September 2022, press spokesperson Udo Pawelczyk described organisational and technical changes. He said the district administration had placed the information technology and digitalisation department directly under the district administrator and created an information security officer post. It was also working to introduce “two-factor authentication”, a login using two independent forms of verification. It no longer allowed external devices.
Lessons for CISOs in the DACH region
The publicly documented sequence offers five lessons for security leaders in public administrations and businesses.
- Report service resumption and full recovery separately. In Anhalt-Bitterfeld, individual services were available again from August 2021, while the recovery process was expected to continue beyond May 2022, according to the BKA (Federal Criminal Police Office). Status reports to management and oversight bodies become more reliable when they track both states separately.
- Set the order of critical processes in advance. The district drew up its priority list for the emergency network after the attack. An agreed ranking of critical processes in the emergency plan takes this work out of the acute crisis.
- Clarify the legal basis for escalation levels. The district used the disaster declaration to gain broader response options. Authorities can consult civil protection agencies in advance on when this instrument may be appropriate; the equivalent for companies is a crisis team with clearly defined powers.
- Decide on ransom payments before a crisis. The district says it refused to pay. With double extortion, this assessment covers access to data and the threat of publication. Management can weigh both more carefully before it faces time pressure.
- Anchor security responsibility at the top. In September 2022, the administration described placing IT directly under the district administrator and creating the information security officer post. Such a reporting line can be established before an incident occurs.
Frequently asked questions
All questions are collapsed by default. Tap a question to reveal the answer.
Which vulnerability did the attackers exploit in Anhalt-Bitterfeld?
According to topeins, the magazine of the DGUV (German Social Accident Insurance), the vulnerability exploited in the attack remained unknown in September 2022. The attackers’ entry point was therefore still unconfirmed at that time.
What currency did Grief demand the ransom in?
The group Grief demanded the ransom in the cryptocurrency Monero. The district says it refused to pay.
What malware protections did the DGUV recommend?
In September 2022, the DGUV’s recommendations for public administrations and businesses included timely updates, backups and user accounts with limited privileges. It also recommended regular security training that expressly includes managers.
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
