Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Ransomware attack on the Anhalt-Bitterfeld district, Germany, 2021
In early July 2021 a ransomware attack on the district of Anhalt-Bitterfeld in Saxony-Anhalt, Germany, nearly stopped the whole district administration.
In short
In early July 2021 a ransomware attack on the district of Anhalt-Bitterfeld in Saxony-Anhalt, Germany, nearly stopped the whole district administration. The district declared a disaster on 9 July 2021, and the BSI, Germany's federal cyber agency, said no other local authority had done so after a cyberattack. The state lists the disaster as lasting until 31 January 2022. It matters because it showed that a local government's IT failure can stop welfare payments and vehicle registration for weeks.
What happened
In early July 2021 criminals infected several servers of the district of Anhalt-Bitterfeld with malware and encrypted data, according to the BSI. The BSI said the attack nearly paralyzed the whole district administration (BSI newsletter, 12 August 2021). A district spokesperson told Reuters, “We are almost completely paralyzed.”
Because of the scale of the attack the district declared a disaster. The Saxony-Anhalt interior ministry lists it from 9 July 2021 to 31 January 2022. Reuters called it a formal step that allows a district to ask for federal help. The BSI told Reuters that other local authorities had been hit by cyberattacks, but none had declared a catastrophe as a result.
The district, home to 157,000 people, could not for the time being pay out welfare benefits, Reuters reported. On 22 July 2021 the district said vehicle registration was still not possible and gave it, with driving licenses, top priority. It said it could meet end-of-month payments such as social benefits using the previous month’s figures.
The state government later said the whole district administration was affected. According to its answer to a Landtag question of October 2021, about 62 GB of data was spied out and the offenders published 1,699 files. The state police checked a sample of those files and found no content of the kind the question asked about. The district refused to say who the attacker was or whether a ransom was demanded, citing the police investigation. The sources opened name no attacker.
Timeline
-
November 2020
An IT security officer is appointed for the district. Concrete security rules are still being drawn up when the attack happens, per the state government.
-
Early July 2021
Criminals infect several servers with malware and encrypt data, per the BSI.
-
9 July 2021
The state lists the start of the disaster for the district. A state information security officer starts supporting on site the same day.
-
10 to 12 July 2021
A district spokesperson says the district is almost completely paralyzed. Reuters reports the disaster declaration and that the BSI has sent a crisis team.
-
22 July 2021
A BSI specialist team arrives on site. Vehicle registration is still not possible, and the district says it will pay end-of-month obligations on the basis of the previous month.
-
12 August 2021
The BSI newsletter again warns against paying ransom.
-
20 October 2021
The state government answers a Landtag question. It reports about 62 GB of data spied out and 1,699 files published by the offenders.
-
31 January 2022
End of the disaster period as listed by the Saxony-Anhalt interior ministry.
How the attack worked
The sources opened give no technical report. They do not say how the attackers got in, how long they were inside, or which malware was used. Only the following is stated.
Servers infected and data encrypted
The BSI says criminals infected several servers with malware and encrypted data in early July 2021.
Data stolen and published
The state government says about 62 GB of data was spied out and the offenders published 1,699 files, to its knowledge. The encrypted data could not be inspected.
Reach into the whole administration
The state says the whole district administration was affected. Fire and disaster protection and pandemic control were not, because of separate local IT in Bitterfeld rather than Koethen and federal IT.
- Servers infectedCriminals infected several servers with malware
- Data encryptedData was encrypted and the administration nearly stopped
- Data spied outAbout 62 GB was spied out and 1,699 files were published, per the state
- Disaster declaredThe district declared a disaster, lasting to 31 January 2022 per the state
Who says who was behind it
No attacker is named in the sources opened. The district declined to name the attacker (Reuters, 12 July 2021). The state police opened an investigation.
Impact
The BSI said the attack nearly paralyzed the whole district administration. The district could not for the time being pay out welfare benefits (Reuters, 12 July 2021).
Vehicle registration was not possible on 22 July 2021, and driving license services were also a priority to restore (district press release).
The state says the attack touched tasks the state hands to districts, such as building supervision, health service and social benefits, because the whole administration was down.
About 62 GB was spied out and 1,699 files were published, per the state government.
The state lists the disaster as lasting until 31 January 2022.
Government and regulator response
- 9 July 2021: The district declared a disaster. A state information security officer began supporting on site.
- July 2021: The state finance ministry provided external IT experts under framework contracts. The BSI sent a crisis team and, on 22 July, a specialist team on site.
- July 2021: The district put vehicle registration and driving licenses first, and kept paying social benefits using the previous month’s figures.
- 2021: The state police opened an investigation. The BSI president again warned against paying ransom.
- October 2021: The state said information exchange between state and municipalities had weak points and set up a working group to involve municipalities in the state information security system.
Lessons
-
Small bodies can be fully stopped
A rural district of 157,000 people was almost fully paralyzed. Size does not protect a public body.
-
Security rules must exist before the attack
An IT security officer had been appointed in November 2020, but concrete rules were still being drawn up.
-
Plan for payments and core services
The district had to pay benefits using the previous month's figures. Agree fallback plans for payments and registration.
-
Link local and state response
The state said information exchange with municipalities had weak points. Agree who calls whom before an incident.
-
Outside help arrives in days, not hours
State experts and the BSI team came on site in days to weeks. Keep offline copies and a tested restore plan.
-
Do not pay without thinking
The BSI president warned that ransom payments feed a dangerous business model.
What to check in your own organization
-
Offline backups
Confirm backups are kept offline and a full restore has been tested.
-
Critical services list
Write down which services must run first, such as payments and registration, and a manual fallback for each.
-
Security rules in place
Check that written security rules exist and are in force, not still in draft.
-
Server segmentation
Check whether one infected server can reach the rest of the administration.
-
Contact chain
Know who to call at the state and the BSI, and keep the numbers on paper.
-
Decision on ransom
Agree in advance who decides on ransom and what advice they take.
-
Data leak plan
Plan how to check published data and notify affected people.
Where it happened
- Country Germany Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
What happened?
In early July 2021 criminals infected servers of the Anhalt-Bitterfeld district with malware and encrypted data, nearly stopping the administration (BSI).
Why is it called a first?
The BSI told Reuters that no other local authority had declared a catastrophe after a cyberattack before.
How long did the disaster last?
The Saxony-Anhalt interior ministry lists it from 9 July 2021 to 31 January 2022.
Who was behind it?
The sources opened do not say. The district declined to name the attacker and the police investigated.
Was data stolen?
The state says about 62 GB was spied out and the offenders published 1,699 files.
Were emergency services hit?
The state says fire and disaster protection and pandemic control were not affected.
Sources
- District council declares Germany's first cyber-catastrophe (Reuters, 12 July 2021) Business Insurance, carrying Reuters
- SICHER - INFORMIERT, 12 August 2021 BSI
- Presseinformation Cyber-Angriff, 22 July 2021 Landkreis Anhalt-Bitterfeld
- Drucksache 8/288, Antwort auf KA 8/104 (20 October 2021) Landtag of Saxony-Anhalt
- Drucksache 8/1796 (21 October 2022) Landtag of Saxony-Anhalt
- BKA warnt vor Cyber-Angriffen auf öffentliche Verwaltungen Bundeskriminalamt (BKA)
- BSI-Roadshow gab Hilfestellungen zur Cyber-Sicherheit in Sachsen-Anhalts Kommunen BSI
- Informationssicherheit in Kommunen: Maßnahmen gegen digitale Angriffe Bundesinstitut für Bau-, Stadt- und Raumforschung (BBSR)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.