Cyber Incident Victim: Aéroport de Pau
Date:
May 2024
Location:
France
Summary
A cyberattack targeting Pau airport and a business school degraded operations but did not halt core activities, with flights continuing normally and classes proceeding without some digital tools. The incident, suspected to involve ransomware, resulted in confirmed data theft prompting notifications to France's data protection authority, though the attack's origin remains undetermined. Investigations by a cybersecurity contractor are ongoing, and a legal complaint is being prepared, while the irony of the breach is noted as the affected business school's parent organization hosts a regional cybersecurity initiative.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 13, 2024, the Pau Airport and a local business school managed by the CCI Pau Béarn experienced a cyberattack disrupting their digital operations. The attack forced both entities into degraded operational modes, though critical functions remained operational. Airport flight schedules were unaffected, with no disruptions to passenger services. At the business school, classes proceeded normally but without access to a portion of digital teaching tools. The CCI Pau Béarn confirmed ongoing investigations, engagement of a cybersecurity contractor, and plans to file a formal complaint. Initial evidence suggested the attack involved ransomware, malware designed to block access to systems or files until a ransom is paid, though no explicit ransom demand or payment details were disclosed at this stage.
The attack resulted in confirmed data theft, prompting notifications to the French National Commission for Information Technology and Civil Liberties (Cnil). The Cnil acknowledged receiving multiple reports of personal data breaches linked to the incident but clarified that analysis by the victims remained ongoing, preventing further specifics about the compromised data’s nature or scope. The incident occurred despite the CCI Pau Béarn’s campus serving as the local hub for the Nouvelle-Aquitaine Regional Campus of Cybersecurity and Digital Trust, highlighting the attackers’ deliberate targeting of this institution. This event followed prior ransomware attacks against local emergency services and healthcare infrastructure in recent years, including the Sdis 64 fire department in October 2023 and Oloron-Sainte-Marie Hospital in early 2021. Restoration efforts and forensic analysis continued without public confirmation of full system recovery or attribution to a specific threat actor.