Bouygues Construction

Summary

Bouygues Construction proactively shut down its computer network to contain a Maze ransomware attack detected on its systems, preventing further propagation while maintaining operational continuity at construction sites. The ransomware operators claimed responsibility for encrypting hundreds of devices and exfiltrating over a thousand terabytes of data, indicating potential unauthorized access to sensitive information prior to encryption. The company engaged cybersecurity experts to restore affected systems and prioritized minimizing disruption to customers and partners throughout the incident response.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 30, 2020, Bouygues Construction detected a ransomware-type virus within its information systems. The French construction firm immediately implemented a precautionary network shutdown to prevent further propagation of the attack across its infrastructure. This decisive containment action was publicly confirmed through a company statement, which emphasized operational continuity at construction sites despite the IT disruption. Internal teams collaborated with external cybersecurity experts to assess the incident and initiate restoration procedures. All personnel were directed to prioritize minimizing impacts on customers and business partners during the recovery process. The company maintained operations through alternative methods while core systems remained offline.

Maze Ransomware operators subsequently claimed responsibility for the attack, asserting they had encrypted 237 corporate computers and accessed over 1,000 terabytes of data. This ransomware group's established tactic of exfiltrating data prior to encryption created potential secondary risks of data exposure beyond the immediate system disruption. Bouygues Construction did not publicly confirm the attackers' specific claims regarding encrypted devices or data volumes. The organization's website statement provided no details about data compromise or ransom demands, and company representatives declined to respond to media inquiries about these aspects. While the full scope of data impact remained unverified, the proactive network isolation and transparent incident disclosure were documented containment measures. Business operations continued unaffected at physical construction sites throughout the incident response period.

Sources

Sources available to members: 1 source.