Ined, France's public demographics institute, shuts down its entire network after an intrusion

On Saturday, October 17, the IT department of the Institut national d'études démographiques (Ined, the French National Institute for Demographic Studies) detected an intrusion on its servers. The response was drastic: the institute isolated its information system and cut access to its servers to keep the attack from spreading. Since then, email, the website and access to data have been affected.

Ined, a public research institution founded in 1945 and based in Aubervilliers, made the attack public a few days later. A crisis unit has been set up. The supervising ministries, ANSSI (France's national cybersecurity agency) and the CNIL (the French data protection authority) have been notified, and the institute says it has filed a complaint.

Was data stolen?

That is the question to ask about any research organization, and it matters here. Ined conducts surveys in demography, sociology, economics and epidemiology, some of them on intimate subjects: family, health, violence, migration, end of life. These databases contain participants' individual responses, and their content is sensitive.

For now, the institute reports no confirmed exfiltration. No ransomware group has publicly claimed the attack. The attackers' entry point, the extent of their access and the timeline for restoring services are unknown. The institute says everything is being done to restore its IT environment safely, and promises to keep its partners and users informed.

What Ined's reaction shows

Cutting the whole network as soon as an intrusion is detected is costly: researchers lose their tools, and partners lose their exchanges. Yet it is the reflex authorities recommend when the scale of an intrusion is unknown. For an organization of comparable size, the lessons are the classic ones:

• prepare an isolation procedure in advance, including ways to communicate without the usual email;
• keep tested, offline backups so you can rebuild;
• know which databases contain personal data, so you can notify the CNIL quickly, within the 72-hour deadline set by the GDPR.

What happens next depends on the investigation. If a claim appears, or if the institute finds a leak, it will have to say which surveys and which people are affected.