From separate sources, “INP Grenoble is currently undergoing a large-scale cyber attack which resulted in many computer accounts being compromised.”
A message attributed to the Inria DSI Security Operations Center (SOC) team uses these terms. It does not appear to be distributed indiscriminately: it appears to be intended exclusively for Inria personnel who have been in correspondence “with at least one person from the INP Grenoble”. And this for a fear: “it may be that your account and your computer have been compromised as a result of one of these exchanges”.
Personnel who have opened an INP file, clicked on a link, used an IT resource or connected their computer to its network during “these last 5 months” must act in advance: change their password, but also report to CERT Inria .
From the outside, Grenoble INP – UGA appears largely disconnected from the internet. His website, for example, is unresponsive, as is Ense3’s VMware Horizon environment web portal. But not all resources seem affected. Three Zimbra portals, for example, are still responding.
Together with the editorial team, the communication department of Grenoble INP rejects any cyber-attack. It only mentions “glitches on our servers” which led to the isolation, or even shutdown, of many of them. And to add that there is “nothing dramatic”.
This spokesperson was unable to tell us the nature of the “anomalies.” But for him they are more than enough to justify the measures taken, even if these may seem significant and raise suspicions of a cyber attack. An external service provider was called in to investigate these “exceptions”. His identity has not been given to us.
In mid-September, Toulouse INP was hit by a cyber attack involving ransomware. The latter’s family has not been specified and the attack has not, to date, been claimed. The directory had been affected by encryption, blocking authentication mechanisms, to the point of degrading physical access capabilities to buildings.
