Rhysida claimed the ransomware attack on Martinique's territorial government

The Collectivité Territoriale de Martinique, the authority that governs the French overseas territory, detected a cyberattack on May 16, 2023 that forced it to isolate its information systems and left services across the administration effectively paralysed.

The disruption reached education, social assistance and finance. Schools and secondary schools lost internet access, online applications for administrative aid became unavailable and staff fell back on paper processes. The collectivity published its own first notice on Facebook on May 24, eight days after Martinique la 1ere reported the attack, acknowledging that the attack had heavily disrupted its activities and directly affected users and partners.

In early June the Rhysida ransomware group, which had itself only emerged that May, claimed the attack through its negotiation portal and posted sample documents including identity cards, passports and cost estimates. RCI Martinique reported that the intrusion may have begun around May 5 and gone undetected until May 16, and described relatively conventional phishing as the entry method. Rhysida gave no figure for the volume of data taken.

The collectivity confirmed that data had been exfiltrated and said it would notify France's data protection authority CNIL on June 9 and file a further complaint with cybercrime prosecutors. President Serge Letchimy said the attackers had been identified. Priority services were restored progressively, including payments of the APA elderly care allowance and the PCH disability allowance. No ransom figure was made public.