Cyberattacks, a serious threat to the Paris 2024 Olympics

La cybersécurité est une préoccupation des JO de Paris MAXPPP – Nicolas Landemard/Le Pictorium

À moins de 200 jours de l'ouverture des JO de Paris, les autorités françaises se préparent à d'éventuelles cyberattaques. Ces attaques représentent de véritables menaces d'un point vu logistique, des mises en situation sont effectuées pour empêcher la mise en péril des jeux de Paris. 

The clock stopping halfway through 100 meters, the Olympic swimming pool plunged into darkness or the access gates to the stadium blocked: police, gendarmes and specialized services anticipate a “considerable” number ; of cyberattacks during the Paris Games, up to the most critical hypotheses.

During the last Olympic Games in Tokyo, 450 million attacks and 4.4 billion cyber threats were recorded, or 800 per second, in a capital yet placed under a health bubble, without spectators .

With 15 million visitors expected in Paris next summer, "we expect it to be considerable", confides to the&#39 ;AFP General Christophe Husson, head of the Cyberspace Command of the Ministry of the Interior (ComCyber-MI), placed under the authority of the gendarmerie.

"Eight to ten times more", said the director of technology for Paris 2024, Bruno Marie-Rose, last April.

To give a figure "would be to read in a crystal ball", but Mr. Husson notes the "giant multiplier factor, by 5 or 20, depending on whether the ;we retain successful or attempted attacks, according to the specialized press" between the London Games in 2012 and those of Tokyo in 2021.

The gendarmerie has also recorded a 42% increase in cyber incidents over the past five years. "For several years now, we have seen a democratization of the provision of tools allowing the commission of computer attacks", underlines the controller general Nicolas Guidoux, head of the Office anti-cybercrime (Ofac), national coordinator of judicial investigations.

"We are no longer facing a few hackers in their room, but facing a multiplication of attackers", he adds.

80 critical targets

During the last Rugby World Cup, in the fall of 2023 in Paris, a few "weak signals" have been observed, such as denial of service attacks which blocked some private or administration sites for a few hours, without there being any major operational impact. quot;, according to General Husson.

The main threat concerns ransomware attacks, which are constantly increasing, with 546 investigations opened in France in 2023, an increase of 30% compared to 2022, according to the Paris prosecutor's office which has national jurisdiction.

They generally consist of encrypting or stealing a victim's data and demanding a ransom to unlock it. Vicious, ideological or even… state attacks, the motives of cybercriminals are multiple and their borders are porous.

At the beginning of December, an exercise simulating several simultaneous, high-level ransomware attacks was organized, bringing together several ministries (Interior, Justice, Health, etc.). Others will follow between now and the opening ceremony of the Paris Olympics on July 26.

The National Information Systems Security Agency (Anssi), which manages the cybersecurity of the Games, has listed 350 entities linked to the competition, including 80 critical ones. The latter, "if they suffered a large-scale computer attack, either an event would be canceled, or a large part of the Games could be canceled", Emmanuel Naëgelen, the deputy director, warned in October to the Senate of the Anssi.

Attacks thwarted

But, by taking into account all the subcontractors linked to these entities, the list of potential targets is "much broader", continues Commissioner Nicolas Guidoux .

Contractors are "an easier entry point", their IT systems are "sometimes less robust" than those of large companies, adds Johanna Brousse, head of the section specializing in the fight against cybercrime at the Paris prosecutor's office, who in view of the increase in attacks, calls for strengthening the resources of the magistrates responsible for this large crime.

Last August, the data of 10 million job seekers was put up for sale on the darkweb after a hack of a Pôle emploi service provider. "The Olympic and Paralympic Games are twice 15 days.

💬 "Les JO 2024, une méga cyberattaque sur l'Île-de-France"

VivaTech: une "cybercaserne" pour protéger des hackers pendant les Jeux olympiques pic.twitter.com/P4kDB8kmEU

— Tech & Co (@techandco) June 15, 2023

In 15 days, we cannot rebuild an information system that would have been destroyed by ransomware, Emmanuel Naëgelen explained to senators, emphasizing "banking on detection as efficient as possible. "Since January 2023, we have prevented 44 computer attacks", welcomes Mr. Guidoux. "This is an area on which we must still focus our efforts".

Today, the authorities fear above all else the transition from a "cyberattack with material damage to a cyberattack that would result in deaths or injuries&quot ;, explains Johanna Brousse. "We would change the paradigm", she adds.

Beyond this, hateful content online, fueled by a tense geopolitical context, and scams involving counterfeit notes – more than 200 fraudulent sites have been detected by the gendarmes – or false rentals, will also be closely scrutinized by law enforcement.