Cyber Incident Victim: Montargis

On May 17, 2023, the official website of the Montargis city hall was subjected to a cyberattack. The attack resulted in the website displaying a message reading "Digeon démission" (Digeon resign) for a period of several hours. This defacement persisted from Wednesday, May 17, through Friday, May 19. For a time, the city's email systems and other computer tools were also rendered inoperative and did not function. During this incident, another message, "vive la Russie" (long live Russia), also appeared on the compromised systems. The mayor of Montargis, Benoît Digeon, publicly connected these cyberattacks to an ongoing physical conflict with a local sports association, the Cercle Pasteur Gymnastique. Mayor Digeon stated that the situation was ultimately restored due to effective firewalls that had previously been reinforced following a cyberattack against the Communal Center for Social Action (CCAS) of the municipality three years prior. He announced that a formal complaint would be filed regarding the new incident and expressed hope that by the following Monday, it might be possible to discover who was behind the attacks. The mayor suggested the perpetrator was "someone close to this affair," directly linking the digital attack to the physical dispute.

The physical conflict that preceded the cyber incident involved the Cercle Pasteur Gymnastique club protesting a decision by the mayor's office. The club, with a 128-year history, was being required to vacate its long-time gymnasium by July 10, 2023. In response to this eviction, club members had staged a demonstration in the streets of Montargis a few days prior to the cyberattack. During this protest, a banner was displayed that read "Digeon = exécution." Mayor Digeon interpreted this slogan as a direct death threat against him and filed a criminal complaint against an unknown person (plainte contre X) as a result. The vice-president of the sports association, Florian Sandrin, offered a contradictory explanation, asserting the phrase referred to the "execution" or death of the club itself and not a threat to the mayor's life. He contextualized the banner by noting a fake coffin was also present in the protest march, bearing the name of the association and its dates of birth and death. Video evidence from the club's social networks showed two separate signs with the words "Digeon" and "exécution," with one sign clearly featuring an equals sign between them. The fake coffin was also visible in the footage, though any possible writing on it could not be clearly read.

The mayor maintained his position that the banner constituted an unjustifiable threat, insisting the words had a clear and menacing meaning. The cyberattacks were viewed by the mayor as a direct digital extension of this physical intimidation campaign. In contrast, the sports club denied any involvement or capability in carrying out such an attack. Florian Sandrin expressed that the accusation was almost laughable given the club's lack of technical sophistication, stating, "niveau informatique, on n'est pas très bons, donc aller jusqu'à une cyberattaque ..." (we're not very good with IT, so to go as far as a cyberattack...). He expressed frustration that his club was being portrayed as one that wanted to kill a mayor, calling it difficult to hear and a misrepresentation of their intentions. He believed the linkage of the club to the cyber incident was an attempt to divert attention from the core issue of the association's impending dissolution and loss of its training facility.

The incident garnered political attention and was placed within a broader national context of violence against elected officials. Several senators and deputies, including Caroline Janvier, Richard Ramos, and Jean-Pierre Sueur, issued a press release expressing their support for Mayor Digeon. Their statement affirmed that "the values of democracy are non-negotiable whatever the circumstances" and they firmly condemned the threats made against him. This support highlighted the perceived seriousness of the event amid a concerning national atmosphere regarding the safety of mayors carrying out their duties.

The operational impact of the attack was a temporary disruption to the city's online presence and internal email systems. The defacement message was publicly visible for an extended period. The response action taken by the city involved leveraging its existing cybersecurity infrastructure, specifically its strengthened firewall defenses, to mitigate the attack and restore services. The prior investment in these defenses, prompted by an earlier attack on a different municipal entity, proved critical in recovering from this incident. The mayor's stated response also included the intention to pursue legal action by filing a formal complaint with law enforcement to investigate the origin of the attacks. The conflict between the city hall and the sports association remained unresolved, with the club still scheduled to lose its gymnasium and the mayor refusing to further discuss the eviction, instead focusing on the actions of the association's members. The precise technical nature of the attacks, the exact vector of compromise, and the definitive attribution of the cyber incident were not publicly detailed beyond the mayor's suspicions.