Cyber Incident Victim: Mairie de Berson
Date:
Feb 2025
Location:
France
Summary
The town hall of Berson suffered a ransomware attack encrypting all files on its server, including official civil status and urban planning data, rendering them inaccessible. Hackers demanded a ransom for decryption, which officials refused while filing a police complaint; specialized recovery efforts are underway but success is uncertain. This incident poses a significant financial burden on municipal finances and exemplifies the growing targeting of small communes with vulnerable IT infrastructure by such attacks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the night of February 20th to February 21st, 2025, the town hall of Berson, a municipality of approximately 1,800 residents located in Haute-Gironde within the Nouvelle-Aquitaine region of France, suffered a cyberattack. Attackers successfully infiltrated the commune's computer systems and encrypted all files stored on the municipal server. Following the encryption, the perpetrators issued a ransom demand to the town officials, explicitly requiring payment in exchange for restoring access to the compromised data. The town's First Deputy Mayor, Marie-Claude Noël, publicly confirmed the attack and the ransom demand. Faced with this demand, the elected officials of Berson made the decision not to pay the ransom demanded by the attackers. Instead, the Mayor formally reported the incident by filing a complaint with the Gendarmerie, initiating a law enforcement investigation.
The attack resulted in the loss of access to thousands of official municipal records. Critical data categories affected included civil registry information and urban planning documents, severely disrupting administrative functions. Marie-Claude Noël expressed significant doubt about the possibility of recovering the encrypted data, despite the involvement of a specialized cybersecurity company attempting restoration efforts. The timing compounded the impact, as the newly installed municipal team, in office only since December 8th, 2024, had not yet voted on the annual budget. The First Deputy Mayor acknowledged that the financial consequences of this ransomware attack would inevitably burden the commune's finances. The incident exemplifies the growing trend of ransomware attacks targeting smaller municipalities like Berson and Bain-de-Bretagne, often attributed to perceived vulnerabilities in their IT infrastructure.