Cyber Incident Victim: Finistère Habitat
Date:
Nov 2020
Location:
France
Summary
Finistère Habitat, a social landlord, suffered a severe ransomware attack by the NetWalker group, leading to prolonged operational paralysis across its departmental services. The attackers encrypted critical data and issued a ransom demand with a deadline, threatening to publicly disclose stolen information if unpaid. The organization confirmed it would not comply with the extortion attempt, despite facing continued service disruptions and potential exposure of sensitive data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Finistère Habitat, a social housing organization in France, experienced a significant cyberattack beginning approximately November 3, 2020, which severely disrupted operations for over ten days. By November 13, the organization confirmed it had been paralyzed by a ransomware attack identified as NetWalker, a malware variant designed to encrypt data and extort payment for decryption. The attackers established a deadline of the following Thursday evening for Finistère Habitat to pay an unspecified ransom, threatening to publish stolen data if their demands went unmet. This ultimatum appeared on the NetWalker cybercriminal group’s dark web blog, which they used to publicly pressure victims. Finistère Habitat explicitly stated it would not comply with the extortion attempt, rejecting negotiations with the threat actors. The attack rendered critical departmental services inoperable, though specific affected systems or operational areas were not detailed in available reports.
The incident caused prolonged operational disruption, hindering Finistère Habitat’s ability to deliver housing services during the containment period. NetWalker’s operators amplified pressure by leveraging their dark web platform to announce the breach and deadline, a tactic intended to coerce payment through reputational risk. No evidence suggests data was published before the deadline, and Finistère Habitat did not disclose whether decryption occurred or if backups were utilized for recovery. The organization maintained public transparency by acknowledging the attack through media statements but provided no further technical specifics regarding mitigation steps or forensic findings. Consequences included sustained service interruptions and potential exposure of stolen information, though the scope of compromised data remained unverified in available sources. Finistère Habitat’s refusal to pay aligned with standard law enforcement guidance against funding criminal enterprises during ransomware incidents.