Cybersecurity: the digital collapse of French communities

© amine photographe/Pexels

The figures sound like a warning. Of the 1,700 elected officials and local government officials surveyed in communities with fewer than 25,000 inhabitants, 45% admit to having been victims of computer attacks whose cause remains unknown. Even more worrying, one in ten administrations report having suffered malicious intrusions, with this rate doubling for municipalities with more than 5,000 inhabitants.

Behind these statistics is a portrait of territorial institutions that are ill-prepared to face the digital challenges of the 21st century. There is no shortage of examples just for this year: between the colossal hacking of Free, the attacks during the Olympic Games this summer or the LockBit offensive on the Simone-Veil Hospital in Cannes, the cybersecurity landscape has rarely been so shaken on national soil.

A vulnerability masked by false confidence

The study reveals a striking paradox: 53% of local authorities say they have satisfactory IT protection, a perception up six points compared to 2023. This confidence is based on the installation of very basic equipment: antivirus (88%), backup systems (85%) and firewalls (61%).

However, only 14% of them consider themselves truly prepared to face a cyberattack. These tools are certainly essential, but they only constitute a first line of defense and are absolutely not enough to guarantee complete protection.

Half do not have any business continuity or recovery plan (BCP/DRP), while 28% are unaware of the existence of such procedures in their structure. Yet these are essential documents that detail the actions to be implemented to maintain or restore the activities of an entity in the event of a major IT incident. A sort of rescue plan to get out of the storm.

Unsurprisingly, the consequences are heavys : 40% of the targeted communities suffered service interruptions following an attack, not to mention data theft and destruction, which concerned 12% and 15% of them respectively.

Budgetary strangulation, a reflection of a lack of understanding of the issues

The roots of this global vulnerability lie in a worrying financial reality. Seven out of ten local authorities operate with an annual IT budget of less than €5,000, of which more than three quarters spend less than €2,000 on their digital security. Such a limited IT budget, and more particularly such a limited security budget, suggests numerous flaws in the defence systems of the local authorities concerned.

Furthermore, two thirds of administrations are not planning any increase in these resources for the coming year. Indeed, cybersecurity can be seen as a long-term investment, less of a priority than more immediate expenses, and local elected officials are not always aware of the importance of this aspect.

A real budgetary paralysis, which is accompanied precisely by a chronic underestimation of threats: 44% of structures, particularly municipalities with fewer than 300 inhabitants (49%), consider the risk of cyberattacks to be low, or even very low.

Faced with this observation, local authorities are calling for a triple action. 45% of them believe that technical support for their teams should be strengthened, 54% would like to improve the range of security tools and 62% are calling for greater awareness among their teams.

And the State in all this ? It could impose performance obligations on local authorities in terms of cybersecurity, while leaving them a certain latitude in choosing the means to implement. Of course, establishing such a framework would require the release of sufficient subsidies, tax credits or the use of European funding. The feeling of being abandoned by the State is a historical recurrence for small municipalities in France, ideally, it would be good if history did not repeat itself.

• Nearly 45% of small communities have suffered cyberattacks without identifying their origin, revealing a significant systemic vulnerability.
• Most communities say they are well protected, but lack emergency plans and advanced tools.
• With budgets of less than €2,000, they underestimate the risks and struggle to prepare.

📍 To not miss any Presse-citron news, follow us on Google News and WhatsApp.

[ ]