Cyber Incident Victim: Marseille, Provence-Alpes-Côte d’Azur, France
Date:
Dec 2024
Location:
France
Summary
Pro-Russian hacking group NoName05716 conducted a distributed denial-of-service attack targeting multiple French cities, including Marseille, causing temporary website outages without data compromise. The group claimed responsibility on Telegram, framing the attack as retaliation against perceived anti-Russian sentiments. Investigations were initiated by domestic security agencies, with most services restored promptly. Additional targets included government domains related to French overseas territories, though these remained operational during reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On December 31, 2024, multiple French municipal websites, including those of Marseille, Nice, Nantes, Le Havre, Angers, Bordeaux, Pau, Tarbes, and Montpellier, experienced widespread disruption due to a coordinated cyberattack. The pro-Russian hacker group NoName05716 claimed responsibility for these distributed denial-of-service (DDoS) attacks, which deliberately overloaded servers by flooding them with excessive requests, rendering official city portals inaccessible. Initial impacts were reported in Marseille and Nice during the morning, with subsequent attacks expanding to other municipalities throughout the day. Marseille authorities confirmed their OVH-hosted servers activated automated protection mechanisms during the attack, intentionally disabling website access to prevent system compromise. Nice Mayor Christian Estrosi publicly confirmed no data breaches occurred but reported the incident to France's National Cybersecurity Agency (ANSSI) for analysis. Technical teams worked to restore services, with most affected city websites returning online within hours as attackers' traffic volumes subsided.
The Paris Prosecutor's Office initiated an investigation into the attacks, assigning the case to the General Directorate for Internal Security (DGSI). NoName05716 publicly celebrated the disruptions via Telegram, characterizing the DDoS strikes as "shells" targeting what they termed "Russophobic France" ahead of the New Year. The group simultaneously claimed attacks against French territorial government domains for Polynesia, New Caledonia, and the Paris Police Prefecture, though these targets remained operational during the incident. Forensic analysis indicated standard DDoS methodology without evidence of network infiltration or data exfiltration, consistent with the group's pattern of temporary service disruption for symbolic impact. Municipal authorities maintained continuous coordination with ANSSI throughout the recovery phase while monitoring for recurrent attack waves. Service restoration timelines varied marginally across jurisdictions based on local infrastructure resilience and mitigation protocols.