Christophe Vandamme, Managing Director of Servimo Savoies, one of the entities of a real estate services group (sanitation, electricity, plumbing, etc.), will remember this March 3 for a long time.
A little before 7 am, at the head office of Vaulx-en-Velin (Rhône), "strange things" occur at the level of the call center, accessible 7 days a week and 24 hours a day. The three people of the IT department, immediately alerted, quickly conclude a cyberattack.
The virus, initially injected into an email that an employee opened without paying attention, spreads very quickly and affects all internal servers.
The criminals demand a ransom of 3,500 euros, payable in electronic money (bitcoin), in exchange for the pirated data.
IT is responding.
“They immediately cut everything they needed, across the entire network,” says Christophe Vandamme.
While some computers end up "burned out" within the parent company, he himself, in Chambéry (Savoie), is de facto deprived of any communication with his customers, access to the day's schedules, emails ... and loses all of the data for the day.
“I find myself in the dark,” he continues.
The only possible interventions are when a customer called to report that we were late.
"
Notify customers one by one
The situation quickly becomes very problematic, because the company regularly intervenes in emergency for social landlords.
Christophe Vandamme then takes his phone to warn his clients of the situation one by one and postpone the interventions: “It's the only thing I could do at my level.
"
Meanwhile, the IT department has enlisted the help of an outside company and is starting a 24-hour marathon to prevent the attack from doing too much damage.
“The people who assisted us emptied our servers of all data, then re-supplied them with updated backups,” explains Christophe Vandamme.
“But,” he emphasizes, “on the advice of the police, we did not pay the ransom.
"
The network is restored the next day.
As to whether data was indeed intercepted, the Director General is unable to deny or confirm it.
“The IT department is still in the investigation phase,” he explains.
In particular with OVH, their external host for emails.
READ ALSO>
Victim of a cyberattack, the Pierre Fabre pharmaceutical group closes factories
Morning essentials newsletter
A tour of the news to start the day
Subscribe to the newsletterAll newsletters
It is also impossible for him to assess its financial cost to date.
“The impact is not so much on the shortfall.
It is the surplus activity committed to reschedule all the staggered interventions that weighs, ”he believes.
About three weeks later, Christophe Vandamme, whose mailbox is still disrupted, also awaits a return from the CEO on this attack, in order to better understand what happened.
“It makes you think, even if working without computers is impossible,” he admits.
But already, Servimo has stepped up its level of vigilance and that of its employees (300 in total but nearly 60 with access to a computer): regular updates and checks, switching off devices every day. evenings, memo to the slightest incident… “Even if, confesses Christophe Vandamme, fatalist, we have more and more efficient people in front of them who manage to outsmart the antivirus.
"