Espace Numérique de Travail

Summary

A cyberattack targeted the digital workspace for Île-de-France high schools, disrupting access for up to 300,000 users. The attackers exploited a fraudulent account, which was subsequently blocked by regional authorities. Affected individuals were notified to reset passwords and received guidance on potential unauthorized data use. Regional officials implemented a protective plan with Orange Cyber Défense, aligned with national cybersecurity agency recommendations, while also reporting the incident to cybercrime authorities and formally notifying the data protection regulator of the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 2, 2022, the digital workspace (ENT) used by high schools across Île-de-France experienced a cyberattack that disrupted access for up to 300,000 users, including students and staff. The attack prevented users from logging into the platform for multiple days, significantly impacting educational operations. The Île-de-France regional government confirmed the incident in a public statement, attributing the disruption to unauthorized access by a malicious actor. A formal complaint was filed with the Prosecutor’s Office (procureur de la République) following the attack. The regional administration identified and blocked the specific account responsible for the fraudulent access, though the article did not specify whether this was a compromised legitimate account or a newly created malicious one.

Affected individuals were directly contacted by authorities with instructions to reset their passwords and guidance on responding to potential misuse of their personal data. The region activated a protective action plan developed in collaboration with Orange Cyber Défense, adhering to security protocols recommended by France’s National Agency for Information Systems Security (ANSSI). Concurrently, law enforcement agencies specializing in cybercrime were notified of the breach. Compliance with data protection regulations was maintained through official notification of the incident to the National Commission on Informatics and Liberty (CNIL). No additional technical details regarding the attack vector, data exfiltration scope, or identity of threat actors were disclosed in the source material.

Sources

Sources available to members: 1 source.