Ministère de la Justice

The French Ministry of Justice, also known as the Ministère de la Justice, is the government body responsible for the administration of justice in France. Its core functions encompass the organization and operation of the judicial system, including courts, prosecution services, and the enforcement of judicial decisions. The ministry oversees a wide range of legal and judicial activities, from criminal and civil proceedings to the management of the prison system and probation services. It handles sensitive data, including personal information related to legal cases, victims, and individuals under judicial supervision. The ministry's work is fundamental to upholding the rule of law and public order within the French Republic, serving the entire national territory from its headquarters in France. Its operational integrity is critical for the continuous functioning of judicial processes and the protection of confidential legal information.

The ministry's cybersecurity posture was notably tested in January 2022 when it was targeted in a ransomware attack attributed to the LockBit 2.0 group. The attackers claimed to have stolen data and threatened its public release, prompting an immediate internal investigation and verification processes to assess the breach's scope. Initial reports indicated that while the attack disrupted systems, critical criminal case files were not believed to be compromised. However, the incident exploited unsecured BIG-IP instances, leveraging a known vulnerability that had been patched, highlighting a failure to implement available security updates. This breach aligned with previous internal audit findings that had already identified cybersecurity weaknesses within the ministry's infrastructure. In response, the ministry coordinated with specialized cyber units and security partners to conduct system-wide checks, ensure data integrity, and manage the potential fallout from any data leaks, prioritizing transparency about the incident's consequences while the full extent of data exposure remained under evaluation.