Following a cyberattack observed on ETSI portal, the IT system dedicated to its members’ work, the ETSI IT team worked in close collaboration with the French National Cybersecurity Agency (ANSSI) to investigate and repair the information systems. The vulnerability on which the attack was based has been fixed.

ETSI believes the database containing the list of their online users have been exfiltrated. Since the attack and under the guidance of ANSSI experts, ETSI has fixed the vulnerability, undertaken additional security actions and significantly strengthened its IT security procedures. Following this incident, ETSI asked their online services users to change their passwords.

A judicial inquiry is underway. A notification has also been made to the French data protection authority (CNIL) as required by the General Data Protection Regulation (GDPR).

“Transparency is at the root of ETSI, in our governance and technical work. We have already proved to be quick to react and adapt to crises, Covid being one of them. The shutdown challenged our working procedures and IT systems and we managed to ensure business continuity for both our staff and our members whilst limiting the risks. They were able to keep working without disturbance during that period. For this new crisis, we are very grateful for the knowledge and advice of the experts from the French National Cybersecurity Agency (ANSSI), who have helped us to determine the remedial actions to be taken, and to strengthen the security of our systems,” says Luis Jorge Romero, ETSI Director-General.