France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved

France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved 1

In the night between 5 and 6 December last, the ransomware group Hive managed to penetrate the IT systems of the Syndicat Intercommunal d’Informatique (SII), an IT service provider based in Bobigny, a municipality of 54,000 people north of Paris. In addition to the city of Bobigny, the SII provides IT services and assistance to various other municipalities within the Department of Seine-Saint-Denis in the French region of รŽle-de-France.

At least three other municipalities were affected by the cyber attack: Tremblay-en-France, Le Blanc-Mesnil and La Courneuve, but also the Bobigny public housing offices and the inter-municipal union for collective catering (Siresco) appear to be been affected by this attack – Source: Les Echos -. Currently the Siresco website is offline as well as the official one of the Municipality of Tremblay-en-France which at the moment has been “replaced” by a temporary one reachable at the URL https://tremblay-contact.fr

At this URL instead https://tremblay-contact.fr/2022/01/07/facturation-des-prestations-municipales you can see the note published by the Municipality regarding the cyber attack.

France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved 2

Below are the press releases still present on the institutional websites of the Municipalities of Bobigny, Le Blanc-Mesnil and La Courneuve.

France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved 3

France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved 4

France, Department of Seine-Saint-Denis: ransomware attack, several municipalities involved 5

SuspectFile.com was able to verify the existence of a chat opened by the Hive ransomware group within the TOR networks on December 8, 2021 and which concerns the Municipality of Bobigny. In the chat, Hive sets the ransom price at $ 500,000 in bitcoins by providing the list of files stolen during the cyber attack (listing.txt).

The chat remained still as of December 8, 2021 and to date the victim’s name has not yet been published on the pages of the cybercriminals’ website. SuspectFile.com does not know if there are chats opened by Hive for the other affected entities as well.

Yesterday SuspectFile.com contacted the municipalities of Bobigny, Le Blanc-Mesnil and La Courneuve asking some questions about the cyber attack last December. At the moment, none of the three French municipalities has yet answered us.

We will continue to follow the story by updating it in case of new details.