BTS SIO - Témoignage n°1 - Cybersécurité - France culture

Main points of the episode (France Culture – Les pieds sur terre, Sonia Cronlund)

Context: the growth of cyberattacks in France

• Auto-generated subtitle text frames the issue as part of a rising wave of cybercrime in France, including terms like ransomware and malware.
• The French government is described as having allocated 30 million euros to create a “cyber shield” to protect organizations and citizens.
• The podcast also uses metaphors from piracy / the “Wild West” to characterize the logic of cybercriminals: few rules, focused on survival and effectiveness.

Focus of the testimony: a real-world ransomware attack on a hospital

• Speaker Francine Corneux explains that she was the coordinator of medical secretariats for:
  • CHSF
  • Arpajon hospital center
  • the medical unit of the prison at Fleury-Mérogis
• Attack onset: night of Aug 20–21, 2022, when screens went black and later displayed encrypted text and English messages.
• The hospital activated its emergency response plan, diverting incoming emergencies to other hospitals in nearby departments.

Immediate operational breakdown

Over the first 48–72 hours, systems failed progressively:

• No emails, no network, and no software
• Administrative services and pharmacy services down
• Inability to track medication dosages and chemotherapy preparations
• Automated lab machines not functioning, stopping biological analyses
• Operating rooms and consultations severely impacted due to the loss of computerized visibility and dependencies (imaging, labs, blood supply coordination)

Emergency transfers and “paper recovery”

• The most vulnerable patients (e.g., neonatal babies) were transferred to Paris; about 600 patients remained.
• Medical secretaries had to recreate paper schedules and rebuild traceability for care without reliable digital systems.
• The hospital faced major disruption: patient scheduling, cancellations, and administrative reconstruction under uncertainty.

Human resources and communication strain

• The HR server was encrypted, causing loss of staff records.
• A critical question became how to pay salaries.
• Telephone service was initially preserved, while backups were prepared in case communications also failed.

Ransom demand and data leak

• Printers began producing paper with the attackers’ message.
• The hackers demanded €10 million and threatened to release stolen medical and staff data.
• The attackers are described as a Russian group circulating under the name Logbit.
• When the hospital did not pay, the group released information on the Dark Web, including:
  • test results
  • consultation and surgical reports
  • full patient medical records
  • staff information

Psychological and organizational impact

• Unlike the solidarity seen during COVID-19, the attack resulted in more individual anxiety and tensions during internal meetings.
• A key risk discussed: some doctors attempted to use home computers/USB drives to bypass downtime.
  • The hospital stopped this because it could trigger further compromise until IT could restore systems safely.

Long-lasting effects and gradual recovery

• Over time, secretariat burnout and exhaustion followed (the testimony mentions many sick leaves around Oct 4).
• Recovery happened in phases:
  • September: operations in pen-and-paper mode, focusing on urgent needs
  • Early October: some tools returned, but still degraded
  • Early November: improved access to patients and increased capability
• Restoring email is described as feeling like a “miracle,” but the speaker stresses that the attack will leave long-term scars.

---

Presenters / contributors (listed in the subtitles)

• Sonia Cronlund
• Anna Benjamin
• Francine Corneux