{"id":25585,"date":"2026-10-27T08:00:00","date_gmt":"2026-10-27T08:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=25585"},"modified":"2026-11-03T10:43:13","modified_gmt":"2026-11-03T10:43:13","slug":"anhalt-bitterfeld-and-germanys-first-cyber-disaster","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/27\/anhalt-bitterfeld-and-germanys-first-cyber-disaster\/","title":{"rendered":"Anhalt-Bitterfeld and the first cyber disaster declaration"},"content":{"rendered":"<p><strong>The cyberattack of 6 July 2021 initially brought Anhalt-Bitterfeld&#8217;s district administration to a complete standstill. Effective 9 July, the district declared Germany&#8217;s first disaster caused by a cyberattack. Its end on 31 January 2022 did not mean that IT had been fully&nbsp;restored.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Anhalt-Bitterfeld declared Germany&#8217;s first disaster caused by a cyberattack.<\/strong> It took effect on 9 July 2021 and was intended to give the district broader options for containing the&nbsp;impact.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Recovery remained incomplete for a long time.<\/strong> Neither the return of individual services from August 2021 nor the end of the disaster on 31 January 2022 meant that IT had been fully&nbsp;restored.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">The district rebuilt its technology and organisation.<\/strong> It says it spent around 2.5 million euros on this and created an information security officer post.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2025\/04\/17\/germanys-cybersecurity-is-an-illusion-why-bsi-reports-and-nis2-lull-us-into-a-false-sense-of-security\/\" target=\"_blank\" rel=\"noopener\">Germany&#8217;s cybersecurity is an illusion: Why reports from the BSI (Federal Office for Information Security) and NIS2 give us a false sense of&nbsp;security<\/a><\/p>\n<h2>Background at the district&nbsp;administration<\/h2>\n<p>Anhalt-Bitterfeld&#8217;s district administration was headquartered in K\u00f6then and operated branch offices in Bitterfeld and Zerbst. In summer 2021, all three sites were part of a shared administrative network. The offices provide services that matter to residents, such as vehicle registration, which residents notice immediately when it is unavailable. In July 2021, an attack hit this structure and made the district a precedent for German public&nbsp;administration.<\/p>\n<div data-element=\"definition_box\" style=\"background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;padding:20px 24px;margin:32px 0;box-shadow:0 2px 10px rgba(0,0,0,0.22);\">\n<p style=\"margin:0;color:#e6e3da;line-height:1.6;\"><strong>What is double extortion?<\/strong> Double extortion is a tactic used by ransomware groups in which attackers steal data before encrypting it and threaten to publish it. The victim faces twofold pressure: it wants to regain access to its systems and prevent a data leak. Working backups therefore solve only part of the&nbsp;problem.<\/p>\n<\/div>\n<h2>The attack and&nbsp;timeline<\/h2>\n<p>On <a href=\"https:\/\/www.anhalt-bitterfeld.de\/de\/datei\/download\/id\/32598,1247\/ausgabe_14_vom_13._august_2021.pdf\" target=\"_blank\" rel=\"noopener\">6 July 2021<\/a>, a cyberattack hit the district administration and initially brought it to a complete standstill. It was a ransomware attack. Ransomware is malicious software that encrypts data so attackers can demand a ransom to release it. The encryption affected the administrative network at the K\u00f6then headquarters and the Bitterfeld and Zerbst branch&nbsp;offices.<\/p>\n<p>The group Grief claimed responsibility for the attack. It used double extortion, combining encryption with a threat to publish stolen&nbsp;data.<\/p>\n<p>Effective <a href=\"https:\/\/www.sva.de\/sites\/default\/files\/2022-09\/Cybercrime%20Bundeslagebild%202021.pdf\" target=\"_blank\" rel=\"noopener\">9 July 2021<\/a>, the district declared a disaster. On 31 January 2022, it declared the disaster over. The work was unfinished, however: as of May 2022, the recovery process was expected to&nbsp;continue.<\/p>\n<h2>The decision to declare a&nbsp;disaster<\/h2>\n<p>The most far-reaching decision came shortly after the attack. The district declared a disaster to gain broader options for responding to or containing its impact. It was Germany&#8217;s first disaster caused by a&nbsp;cyberattack.<\/p>\n<p>In parallel, the specialist departments organised emergency operations. After the attack, an emergency network, a provisional IT environment, was set up. By the meeting of <a href=\"https:\/\/ratsinfo.anhalt-bitterfeld.de\/bi\/getfile.php?id=42001&amp;type=do\" target=\"_blank\" rel=\"noopener\">29 July 2021<\/a>, the departments had drawn up a priority list of services relevant to residents for expanding this network. This established the order in which services for citizens would&nbsp;return.<\/p>\n<p>The third decision concerned the extortionists. The district says it refused to pay the demanded&nbsp;ransom.<\/p>\n<h2>Service resumption: outcome and&nbsp;costs<\/h2>\n<p>Vehicle registration illustrates the gradual resumption of services. It was available again from 3 August 2021, initially only at the K\u00f6then administrative site and by telephone appointment. The return of individual services did not mean that IT had been fully restored, and neither did the subsequent end of the&nbsp;disaster.<\/p>\n<p>As of March 2024, the district said it had spent <a href=\"https:\/\/www.n-tv.de\/regionales\/sachsen-anhalt\/Cyberangriff-kostete-Anhalt-Bitterfeld-2-5-Millionen-Euro-article24793758.html\" target=\"_blank\" rel=\"noopener\">around 2.5 million euros<\/a> as a result of the attack. The money went towards rebuilding infrastructure, data recovery, new servers, storage media, laptops and&nbsp;software.<\/p>\n<p>In September 2022, press spokesperson Udo Pawelczyk described organisational and technical changes. He said the district administration had placed the information technology and digitalisation department directly under the district administrator and created an information security officer post. It was also working to introduce <a href=\"https:\/\/topeins.dguv.de\/arbeitssicherheit\/kommunale-it-gegen-cyber-angriffe-staerken\/\" target=\"_blank\" rel=\"noopener\">\u201ctwo-factor authentication\u201d<\/a>, a login using two independent forms of verification. It no longer allowed external&nbsp;devices.<\/p>\n<h2>Lessons for CISOs in the DACH&nbsp;region<\/h2>\n<p>The publicly documented sequence offers five lessons for security leaders in public administrations and&nbsp;businesses.<\/p>\n<ul style=\"padding-left:1.4em;\">\n<li><strong>Report service resumption and full recovery separately.<\/strong> In Anhalt-Bitterfeld, individual services were available again from August 2021, while the recovery process was expected to continue beyond May 2022, according to the BKA (Federal Criminal Police Office). Status reports to management and oversight bodies become more reliable when they track both states&nbsp;separately.<\/li>\n<li><strong>Set the order of critical processes in advance.<\/strong> The district drew up its priority list for the emergency network after the attack. An agreed ranking of critical processes in the emergency plan takes this work out of the acute&nbsp;crisis.<\/li>\n<li><strong>Clarify the legal basis for escalation levels.<\/strong> The district used the disaster declaration to gain broader response options. Authorities can consult civil protection agencies in advance on when this instrument may be appropriate; the equivalent for companies is a crisis team with clearly defined&nbsp;powers.<\/li>\n<li><strong>Decide on ransom payments before a crisis.<\/strong> The district says it refused to pay. With double extortion, this assessment covers access to data and the threat of publication. Management can weigh both more carefully before it faces time&nbsp;pressure.<\/li>\n<li><strong>Anchor security responsibility at the top.<\/strong> In September 2022, the administration described placing IT directly under the district administrator and creating the information security officer post. Such a reporting line can be established before an incident&nbsp;occurs.<\/li>\n<\/ul>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">All questions are collapsed by default. Tap a question to reveal the&nbsp;answer.<\/p>\n<details>\n<summary><strong>Which vulnerability did the attackers exploit in&nbsp;Anhalt-Bitterfeld?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">According to topeins, the magazine of the DGUV (German Social Accident Insurance), the vulnerability exploited in the attack remained unknown in September 2022. The attackers&#8217; entry point was therefore still unconfirmed at&nbsp;that time.<\/p>\n<\/details>\n<details>\n<summary><strong>What currency did Grief demand the ransom&nbsp;in?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The group Grief demanded the ransom in the cryptocurrency Monero. The district says it refused to&nbsp;pay.<\/p>\n<\/details>\n<details>\n<summary><strong>What malware protections did the DGUV&nbsp;recommend?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">In September 2022, the DGUV&#8217;s recommendations for public administrations and businesses included timely updates, backups and user accounts with limited privileges. It also recommended regular security training that expressly includes&nbsp;managers.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (November 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"Anhalt-Bitterfeld declared Germany&#8217;s first cyber disaster in 2021. A case study of disruption, emergency operations and recovery.","protected":false},"author":50,"featured_media":25487,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Anhalt-Bitterfeld","_yoast_wpseo_title":"Anhalt-Bitterfeld and the first cyber disaster declaration","_yoast_wpseo_metadesc":"Anhalt-Bitterfeld declared Germany's first cyber disaster in 2021. A case study of disruption, emergency operations and recovery.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[215],"tags":[],"class_list":["post-25585","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":25485,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25585","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=25585"}],"version-history":[{"count":11,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25585\/revisions"}],"predecessor-version":[{"id":26005,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25585\/revisions\/26005"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/25487"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=25585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=25585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=25585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}