Cyber Incident Victim: City of Morières-lès-Avignon
Date:
Apr 2021
Location:
France
Summary
The City of Morières-lès-Avignon experienced a cyber attack compromising its computer systems, with local authorities aware of the incident but not yet filing a formal complaint. Attackers demanded a ransom of 500,000 euros for a decryption key in a separate but contemporaneous case, though no direct link to this incident was confirmed. The intrusion disrupted municipal operations alongside other French entities, including Douai's town hall, which faced paralyzed communications, and Würth France's prolonged IT system outage suspected to be ransomware-related.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around April 8, 2021, the City of Morières-lès-Avignon in France experienced a cyberattack targeting its computer systems. The incident occurred the same day as a separate attack on Isle-sur-la-Sorgue, though no technical connection between these events was confirmed in available reports. Municipal operations were disrupted by unauthorized access to critical infrastructure, though specific affected systems weren't detailed in public disclosures. Local authorities immediately engaged the Avignon gendarmerie company to investigate the breach, though no formal criminal complaint had been filed at the time of reporting. The nature of the intrusion suggested ransomware involvement based on contextual details from parallel incidents, though Morières-lès-Avignon officials didn't publicly confirm this attribution. Technical recovery efforts commenced while law enforcement documented the attack vectors and scope of compromise.
The incident coincided with cyberattacks against two other French entities - Douai's municipal government and Würth France - though no coordinated campaign was declared. In Douai's case, attackers disabled telephone lines and email systems across multiple departments, creating operational paralysis. While Morières-lès-Avignon's specific disruptions weren't enumerated, the concurrent 500,000 euro ransom demand reported in an unrelated case (potentially involving DoppelPaymer ransomware) highlighted the financial motivations behind such attacks. Würth France separately experienced week-long system outages suspected as ransomware-related, though without official confirmation. Morières-lès-Avignon's response prioritized containment and forensic analysis through law enforcement collaboration rather than public disclosure of technical specifics. The city's decision against immediate legal action suggested ongoing internal assessments to determine full impact before formal proceedings.