Threat watch / Attack
Cholet: city and agglomeration services disrupted after a phishing attack on staff accounts
Since October 30, the Ville de Cholet and Cholet Agglomération, in western France, have been dealing with a cyberattack on several user accounts. The city says it started with a fraudulent email sent to several staff members, linking to a fake login form. It cut internet access as a precaution, notified the CNIL and filed a complaint, and says it found no trace of malware or of massive data exfiltration.
- Sector
- Government & politics
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- A fraudulent email sent to several staff members linked to a fake login form, used to collect their usernames and passwords, according to the city.[1] Checked 9 Nov 2026
- What was stolen
- Login credentials of several staff accounts, which the city says were the main goal of the attack. It found no trace of malware or of massive data exfiltration; a local outlet notes this does not rule out that some data was viewed.[1][4] Checked 9 Nov 2026
- Who was impacted
- Staff and residents of the Ville de Cholet and Cholet Agglomération: phone lines were down until the evening of November 1, and the precautionary internet cut disrupted some digital services. The city has not said how many accounts were compromised.[1][2][3][4] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- The Ville de Cholet and Cholet Agglomération face a cyberattack targeting several user accounts. The city confirms the malicious origin of the incident. [1][3]
- Phone service is back: all the usual phone lines are accessible again, the city says. Teams keep securing the information system. [2][3]
- The city says the attack came from a phishing email with a fake login form. Compromised accounts were blocked, fraudulent links removed and internet access cut. The CNIL was notified, a complaint filed, and Intrinsec's CERT, approved by ANSSI, brought in. Access to digital tools reopens step by step under reinforced monitoring. [1]
- Infos Média Nantes reports that the restart does not yet mean all tools are working normally again. [4]