Cyber Incident Victim: Mairie de Reyrieux

On the morning of Saturday, April 29, 2023, the official website of the town hall in Reyrieux, Ain, France, was compromised in a cyber attack. The initial alert was raised around midday by both residents of the commune and municipal employees who discovered the website was no longer functioning as expected. The primary indicator of the compromise was a message written in Russian that appeared on the site. This message contained content that referenced Russia and the ongoing war, which immediately drew the attention of the local services and prompted a security response. Upon discovery, the municipal procedures for securing their systems were rapidly initiated. The website was taken offline, rendering it completely inaccessible to the public as part of the initial containment measures. By midday on Sunday, April 30, the site remained down and unavailable for use.

The mayor of Reyrieux, Carole Bontemps-Hesdin, characterized the event as a targeted attack, noting that her commune was the only one in the local sector to have been victimized in this manner. She publicly stated that the Russian-language message likely constituted a fake or a malicious act rather than a genuine statement linked to the conflict. In response to the incident, the mayor made the decision to file a formal legal complaint. Her stated intent was to not let the matter pass without investigation and to pursue official channels to determine the precise origin of the cyber attack. She expressed surprise at the event, emphasizing that Reyrieux is a tranquil commune of approximately 5,300 inhabitants and that this was the first time she had encountered such an incident.

Communication with the public was managed through the commune's official Facebook page, where a post confirmed that the website was "currently the subject of a cyberattack." Mayor Bontemps-Hesdin explicitly advised her constituents to avoid visiting the town hall's website until technical reports could be completed and a full understanding of the incident's scope was established. She emphasized a desire to not alarm the population unnecessarily while simultaneously urging caution. Preliminary technical assessments indicated that the attack was largely confined to the public-facing website itself. Initial findings suggested that the town hall's primary server infrastructure had not been successfully breached during the incident. Based on these early investigations, the municipality stated that no personal data appeared to have been exfiltrated from their systems.

The incident occurred within a broader context of elevated cyber threats across France, particularly against public institutions. The National Agency for the Security of Information Systems (ANSSI), the national authority responsible for defending and securing information systems, had noted in its 2022 activity report a resurgence in cybercriminal activity, specifically ransomware attacks, towards the end of that year, with threats maintaining a high level. The Auvergne-Rhône-Alpes region had previously experienced similar attacks targeting various public sector entities, including schools and hospitals. According to ANSSI's data, local authorities represent a significant portion of cyber attack targets, accounting for 23% of reported incidents, behind only the private business sector at 40%. The agency provides resources such as a guide to "computer hygiene" to assist professionals in improving their defensive postures. The attack on Reyrieux's digital presence was a manifestation of these ongoing and persistent threats facing municipalities across the country. The response involved technical remediation efforts to restore the website's functionality and security, coupled with the official legal action undertaken by the mayor's office to seek accountability for the disruption.