Cyber Incident Victim: Syndicat Intercommunal dInformatique (SII)
Date:
Mar 2023
Location:
France
Summary
A cyberattack targeted the Syndicat intercommunal pour l’informatique municipal, disrupting municipal applications and services across affiliated communities. While no data compromise or exfiltration occurred, critical functions were impaired including email processing, family portal access, school and BAFA registrations, and invoice distribution. Restoration efforts prioritized core operations, leading to partial service recovery within weeks, though some systems like correspondence management remained affected longer. Residents experienced delays in administrative responses, necessitating in-person alternatives for registration processes. The syndicate and municipal IT teams collaborated to contain the incident and implement regulatory measures during recovery. Operational normalization proceeded incrementally, with lingering disruptions requiring extended processing timelines for certain requests.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Syndicat intercommunal pour l’informatique municipal (SIIM), an intercommunal IT union serving municipal entities, experienced a disruptive cyberattack during the weekend of March 11-12, 2023. The incident caused operational malfunctions across multiple municipal applications maintained by SIIM, immediately impacting service delivery in associated communities. Technical teams from SIIM initiated containment protocols upon detection, working in coordination with municipal IT departments including Gentilly's Direction des systèmes d'information to isolate affected systems. Investigators confirmed no evidence of individual data compromise or exfiltration, though the attack disrupted critical infrastructure supporting public operations. Initial assessments revealed targeted disruption rather than data theft as the primary objective, requiring comprehensive system diagnostics before restoration could commence.
Service impacts materialized rapidly, with the Family Portal for resident services becoming completely inaccessible and email processing systems experiencing severe delays. The City of Gentilly announced broader municipal service interruptions extending beyond IT systems, including administrative processing slowdowns affecting correspondence, invoicing, and certification workflows. Manual alternatives were implemented for urgent processes: School and BAFA registrations shifted to in-person submissions at the Saint Just Administrative Center with temporary documentation adjustments, while Family Quotient certificates required physical visits due to online system outages. Restoration efforts proceeded methodically, achieving partial recovery of online services by March 24 and full functionality restoration by March 27 for most platforms except the specialized mail processing system, which remained impaired until April 11, 2023. Persistent delays affected response times for communications received during the outage window, with municipalities publicly acknowledging extended processing timelines for correspondence and invoices. All regulatory obligations were fulfilled through incident reporting mechanisms, with service normalization continuing for several weeks after the direct attack vectors were neutralized.