Frontignan la Peyrade

Summary

A municipality in Occitanie, France, experienced a cyberattack involving data encryption, system lockouts, and a ransom demand. The victim refused payment and filed a complaint with Montpellier's cybercrime unit. Immediate containment measures included disconnecting all internet and email access while collaborating with a specialized provider to restore operations. Data recovery efforts leveraged unaffected encrypted backups, though each workstation required individual analysis before gradual network reintegration—prioritizing public-facing services. Telephony remained functional, but email systems faced prolonged disruption requiring additional days for restoration. The incident caused operational inconveniences, with authorities apologizing for service impacts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the night of October 26-27, 2022, the municipality of Frontignan la Peyrade in Occitanie, France, experienced a cyberattack targeting its information systems. Attackers encrypted the local government’s data, locked system access, and issued a ransom demand threatening data deletion if unpaid. The attack was detected promptly, leading the municipality to initiate emergency protocols by the morning of October 27. Frontignan la Peyrade categorically refused to pay the ransom, consistent with broader institutional practices observed across French and global entities facing similar ransomware incidents. The municipality filed a formal complaint with the Montpellier Judicial Police’s cybercrime division, which assumed investigative jurisdiction.

The municipal IT and Digital Services Directorate (DSIN), supported by a specialized external provider, implemented immediate containment measures, including disconnecting all administrative services from the internet and disabling email systems. Recovery efforts focused on restoring encrypted data through a preexisting backup system that remained unaffected due to its own encryption safeguards. A meticulous device-by-device analysis preceded the phased reconnection of networks and software, prioritizing departments with direct public interaction. While landline telephony remained operational throughout the incident, email communications suffered prolonged disruption, requiring several additional days for full restoration. The municipality publicly acknowledged service interruptions and apologized for resulting inconveniences, emphasizing its commitment to securing systems before reactivation.

Sources

Sources available to members: 1 source.