Bretagne Télécom

Bretagne Télécom, also known as Bretagne Tlcom, is a French cloud services provider headquartered in France. The company delivers cloud‑based hosting and data storage services to small business customers. Its infrastructure consists of Windows‑based servers that run customer workloads in a remote environment. By offering managed cloud solutions, Bretagne Télécom enables businesses to access computing resources without maintaining on‑premises hardware. The provider emphasizes service continuity and data availability as core aspects of its offering. These operational focuses are reflected in the backup and recovery practices that support its platform.

On 8 January 2020, Bretagne Télécom was targeted by the DoppelPaymer ransomware group. The attackers exploited an unpatched Citrix ADC vulnerability to gain access to the provider’s environment. Once inside, they encrypted 148 Windows‑based servers that hosted data for approximately thirty small business customers. The ransom note demanded a payment of 35 bitcoins in exchange for the decryption key. Bretagne Télécom chose not to pay the ransom and instead restored all affected systems from existing Pure Storage backups. Recovery times varied considerably among the impacted customers, depending on the size and complexity of their workloads. Although the ransomware operators claimed they found “nothing interesting” and therefore exfiltrated minimal data, the incident highlighted the growing trend of ransomware groups stealing information before encryption. The episode underscored the importance of timely patching and robust backup strategies for cloud service providers. It also demonstrated how backup‑centric recovery can enable organisations to resume operations without yielding to extortion demands.