Cyber Incident Victim: Air France
Date:
Mar 2015
Location:
France
Summary
The Air France mutual society website was compromised by a group identifying as the Algerian Mujahideen, who temporarily replaced its homepage with a red and black screen displaying a political message vowing retaliation for historical French actions in Algeria. The attackers referenced the 1945 Setif and Guelma massacres, claiming to represent Algerian martyrs and threatening further cyber intrusions against French servers. The airline confirmed the defacement was limited to the homepage, promptly took the site offline with assistance from national cybersecurity authorities, and restored functionality while initiating an investigation through its external web hosting provider.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 29, 2015, the website of Air France's National Personal Mutual (MNPAF), a mutual society affiliated with the airline, was compromised by hackers identifying themselves as the "Algerian Mujahideen." The attackers replaced the homepage with a red and black screen displaying a political message in English and French. The defacement referenced historical grievances against France, specifically the 1945 Sétif and Guelma massacres during Algeria's war for independence, where French forces killed thousands of Algerians. The message vowed to avenge the "blood" of Algerian martyrs and mujahideen, stating, "We will not stop hacking French web servers." A screenshot of the defaced page was shared on Twitter, amplifying public awareness of the incident. Air France confirmed the attack targeted only the homepage and lasted briefly before detection.
Air France’s spokesperson stated the breach was discovered on Sunday afternoon, prompting immediate coordination with the French Network and Information Security Agency to take the site offline. The MNPAF website was restored shortly afterward. The airline clarified that the compromised site was hosted by an external service provider, not Air France’s internal infrastructure, and initiated an investigation through this third party. No data breach or operational disruption to Air France’s primary systems occurred. The incident highlighted historical tensions between Algeria and France, with the attackers using cyber defacement as symbolic retaliation for colonial-era violence. Air France’s response focused on containment through external agencies and restoration of the affected page without further elaboration on technical vulnerabilities or long-term consequences.