Cyber Incident Victim: France
Date:
Mar 2024
Location:
France
Summary
Multiple schools in the Lorraine region of France, including departments such as Moselle, Meurthe-et-Moselle, Vosges, and Meuse, were targeted by bomb threats and menacing messages sent via hacked educational digital platforms (ENT). The threats, some claiming affiliation with the Islamic State, prompted evacuations, security perimeters, and temporary closures, with law enforcement conducting sweeps and disabling ENT messaging functions to mitigate further risks. Similar incidents affected nearly 130 schools nationwide over the preceding week, involving messages with violent content like decapitation videos, causing widespread disruption and parental concern.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 25, 2024, a coordinated wave of bomb threats targeted educational institutions across multiple French regions, primarily impacting Lorraine. Threat actors compromised school digital platforms (Espaces Numériques de Travail, or ENT) to disseminate menacing messages overnight and into the morning hours. In Meurthe-et-Moselle, Moselle, Meuse, and Vosges, approximately 20 secondary schools received messages threatening bombings, beheadings of staff, and attacks claimed in the name of the Islamic State. Affected institutions included the Lycée Louis-Vincent in Metz, Collège Grüber in Colombey-les-Belles, Lycée Pierre-Gilles de Gennes in Gérardmer, and Lycée Raymond-Poincaré in Bar-le-Duc. Messages arrived via compromised ENT messaging systems between 1:00 AM and 7:00 AM, prompting immediate evacuations. At Lycée André-Malraux in Remiremont, 900 students were relocated to a nearby stadium, while 1,400 students evacuated from Raymond-Poincaré in Bar-le-Duc. Security forces established perimeters, conducted visual inspections, and deployed bomb squads—as seen at Colombey-les-Belles where 35 gendarmes secured the area pending demining unit deployment. Academic authorities disabled ENT messaging functions across Nancy-Metz academy to disrupt further threat propagation while maintaining pedagogical services.
The incident caused widespread operational disruptions, psychological distress, and criticism of institutional preparedness. Multiple schools—including Lycée Reiser in Longlaville and Lycée Jean Morette in Landres—remained closed throughout March 25 after threat assessments, while others like Lycée Saint-Exupéry in Fameck resumed classes by mid-morning following security sweeps. Parents at Rombas’ Cité scolaire Julie-Daubié expressed intentions to keep children home indefinitely, citing inadequate cybersecurity measures after attackers infiltrated ENT accounts to send graphic threats. Nationally, the attack formed part of a broader pattern: 74 Île-de-France lycées received similar threats on March 21, followed by 22 Seine-et-Marne collèges on March 22 and 11 Strasbourg-area schools on March 23. The Reims rectorate confirmed ENT breaches in Marne, Ardennes, Aube, and Haute-Marne, with some messages embedding decapitation videos matching prior Île-de-France incidents. Law enforcement agencies nationwide coordinated levées de doute operations, while regional prefectures like Meurthe-et-Moselle mobilized internal security forces. Academic authorities filed formal complaints for system breaches, though restoration timelines for ENT communications remained unspecified as of March 25 evening.