Université de Reims Champagne-Ardenne

Summary

The Université de Reims Champagne-Ardenne experienced a massive bot attack targeting its systems, causing severe website disruptions including unresponsiveness, slow performance, and intermittent 404 or 504 errors. The attack aimed to saturate infrastructure, paralyzing operations and affecting all internal servers during a critical enrollment period. University teams prioritized restoring stability and minimizing user impact while advising affected individuals to contact enrollment support services. This incident occurred shortly after a similar attack on another French university, both coinciding with student registration timelines, highlighting heightened vulnerabilities during administrative peak activity.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 2, 2024, Université de Reims Champagne-Ardenne notified its student body via email that its website was undergoing a "massive Bots attack" designed to saturate institutional systems. The offensive severely degraded the site’s capacity to process requests, causing widespread operational paralysis during a critical enrollment period. Technical disruptions manifested as prolonged unresponsiveness, extreme latency, and intermittent HTTP errors—including 404 (page not found) and 504 (gateway timeout) codes—preventing reliable access to academic services. University administrators confirmed all internal servers were compromised by the attack, escalating concerns over systemic vulnerabilities. This incident coincided with the start of the academic year, directly impeding student registration processes and institutional workflows.

The university prioritized restoring system stability and safeguarding user experience, mobilizing technical teams to counteract the attack and minimize operational impacts. Students were instructed to contact enrollment assistance or academic offices directly while services remained disrupted. The attack followed a similar disruption at Université Paris-Saclay days earlier, with both incidents strategically timed to coincide with student enrollment cycles. No data breach or ransomware component was disclosed in the university’s communication, which focused exclusively on the volumetric bot assault. Recovery efforts remained ongoing at the time of reporting, with no resolution timeline provided. Institutional operations faced prolonged uncertainty due to the scale of the infrastructure compromise.

Sources

Sources available to members: 1 source.