Session is blocked, documents and files unusable. On June 6, the employees of the city hall in Sarrebourg have been victims of a cyber attack of this scale. A large part of municipal documents has been encrypted by one or more hackeurs. Ten days later, many of them remain inaccessible, has confirmed the town hall in Figaro. The municipal services continue to this day to work to get them back. The operation could take several more months.
Isabelle Parmentier, in charge of the it infrastructure at the town hall in Sarrebourg “spent the weekend following the attack, to disconnect all computers victims to eradicate cryptolocker of each station, and each server”, said in the Républicain Lorrain Christophe Dauffer, director general of the services of the town hall. Among the data blocked, information relating to human resources, or related to the budgets of the municipality were affected.
right reflexes
Sarrebourg has been affected by a software called Phobos. Behind this barbarous name hides a rançongiciel, that is to say, a computer program that takes hostage of personal data. They often take advantage of security holes in popular programs, such as Microsoft Office or Excel. To do this, it puts in place what are called “cryptolocker”, a sort of padlock on digital, which will encrypt the hard disks or storage media of a computer, rendering its files unusable. The author proposes in general then a decryption key in exchange for a sum of money in cryptomonnaie. In the case of Sarrebourg, the ransom raised was 7.6 bitcoins, the equivalent of more than 53.400 euro. Very quickly, the mayor, Alain Marty has decided to lodge a complaint and not to give in to blackmail. It’s a good habit to Julie Gums, an expert in cyber security. “The different case of a cyber attack by rançongiciel we have learned that he must not give in to requests for payment of hackeurs. Because if we do, we simply aren’t guaranteed to have access to the decryption key. Worse, it can create a precedent and motivate other hackeurs to implement new attacks,” she says in the Figaro .
“The teams of Sarrebourg have also had the right attitude ahead of time by having made backups of some files”, adds the expert. “Once resettled, these backups are used to recover the information blocked by the cyber-attack. It is for this reason that some services have been able to again be available only five days after the attack.” With foresight, the municipality had established an independent department for the management of applications related to identity cards or passports, which has not been touched.
the origin of The attack remains for the moment unknown. It could be coming from a mail, an attachment or an infected link on which you have clicked one of the municipal employees. By prudence, Fabien Di Filippo, deputy of the 4th electoral district of Moselle, has announced that training would be given to the employees of the city hall in Sarrebourg to avoid that one of them might get trapped in the future. “Today, all the it systems of the municipalities are interconnected, the risk is everywhere, and employees must be aware”, he explains in Figaro . Sarrebourg had warned the towns around after having been the victim of another virus in the month of may.
Despite the damage, thanks to these good reflexes, Sarrebourg was able to avoid the disaster scenario of Baltimore. In this american city hit by a rançongiciel on may 7, 10.000 pcs of municipal services have been blocked and could be controlled remotely. This piracy was put at the stop of the sensitive services of the city. At the beginning of June, the city council has estimated the cost of this cyber-attack monster. In a month, Baltimore declares a shortfall of 18 million dollars, of which “8 were lost as a result of deferred revenues, or lost while the city was unable to treat the payments of the inhabitants”, within the framework of local taxes and various taxes, according to Henry Raymond, the director of finance of the city. During the ten years of the Anssi, the agency in charge of cyber security of the State in France, celebrated on 5 June, its director, Guillaume Poupard had warned: “a situation like Baltimore can happen to anyone, including in France”. Sarrebourg can testify to that.
