Paris Museum Network Hosting the Olympic Games Hit by Ransomware Attack

• Several Paris museums, including the Grand Palais, Louvre, and Versailles, were hit by cyberattacks.
• The attack targeted the museum network’s financial data systems in museum shops.
• The security incident did not affect the continuity of the Olympics and Paralympics.

A ransomware attack hit around 40 museums in France's national network, including several Paris museums hosting the Olympic Games events, such as the Grand Palais and Louvre, the Paris prosecutor's office said on Tuesday. However, the Olympics and Paralympics are going on without disruption.

The attack, detected on Sunday, targeted the financial data systems used by the stores and boutiques of around 40 museums across France. The threat actors blocked these systems and reportedly demanded ransom in cryptocurrency not to release the data.

The ransomware incident impacted the Réunion des Musées Nationaux et du Grand Palais (RMN-GP), a public industrial and commercial establishment (EPIC) under the supervision of the Ministry of Culture, and it is believed a collaborator account was compromised by an infostealer.

RMN-GP handles 36 institutions – manages the Grand Palais and the Luxembourg Museum and works with the Cluny, National Archaeology, and Maison Bonaparte museums, the national museums of prehistory, Marc-Chagall, Fernand-Léger, and several castles and palaces. The Versailles was also impacted.

The French National Agency for Information Systems Security (ANSSI) said the attacks did not affect any other information systems related to the Olympics and Paralympics.

As French Prime Minister Gabriel Attal noted, 68 cyberattacks were countered over the first few days of the Olympics, two of which targeted Olympic venues.

No threat actor has claimed the cyberattack, and what kind of data was exfiltrated is unknown. The Paris prosecutor’s office assigned an investigation to determine the scope and culprits to the Brigade for Combating Cybercrime subdivision.