Cyber Incident Victim: Institut national polytechnique de Toulouse
Date:
Sep 2022
Location:
France
Summary
A significant cyberattack targeted the Institut national polytechnique de Toulouse, compromising the majority of its servers and data across all campuses. The institution's IT systems were extensively disrupted, rendering its website inaccessible, though physical safety systems and sensitive data remained unaffected. Attackers encrypted institutional data and demanded a ransom for decryption, prompting the organization to file a formal complaint while withholding its decision on payment.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the night of Monday, September 12, 2022, through Tuesday, September 13, 2022, the Institut national polytechnique de Toulouse (INP Toulouse) suffered a large-scale cyberattack targeting the majority of its servers and data across all campuses. The attack rendered the institution's website inaccessible, displaying only a blank page to visitors attempting access. All establishments within the Toulouse INP group were confirmed to be impacted, with the attack compromising the entirety of the institution's IT infrastructure. A crisis meeting was convened on Tuesday, September 13, to address the incident. The organization filed a formal police complaint regarding the breach but did not initially disclose technical details about the attack vector or specific compromised systems.
The attackers encrypted institutional data and issued a ransom demand for decryption, though INP Toulouse declined to publicly state whether it intended to pay. Physical safety systems and building security controls remained unaffected, while sensitive operational elements were reportedly preserved from compromise. No data exfiltration or secondary impacts beyond the encryption and system disruption were mentioned in initial reports. The institution maintained operational continuity for non-IT-dependent functions but faced significant disruption to digital services and information access. Response efforts focused on containment and forensic analysis through collaboration with law enforcement and cybersecurity authorities.