Skip to content
←Back to glossaryCyber

TV5Monde attack (2015)

Sabotage that took TV5Monde's twelve channels off air on the night of April 8 to 9, 2015. Claimed by a jihadist "CyberCaliphate", it was later linked by investigators to APT28: a textbook false flag.

Definition

On April 8, 2015, around 10 pm, TV5Monde's twelve channels went black. The channel's social media accounts showed Islamic State messages, signed by a "CyberCaliphate". The attackers had gone well past defacement: they had destroyed the software of the broadcasting equipment, after weeks of reconnaissance inside the network. ANSSI stepped in overnight. In June 2015, the French press reported that the investigation led to APT28, the group tied to Russian military intelligence. The CyberCaliphate was a fabricated claim. The channel's director general, Yves Bigot, put the 2015 cost at between 4.3 and 5 million euros, then several million a year for security. The case became the reference for false flags. For an underwriter, it shows that the claim of responsibility is the least reliable piece of an attribution file. It also shows that the characterization shifts as the investigation goes on: an attack first read as terrorism, covered or excluded under other clauses, becomes a state operation two months later. A policy that separates cyber terrorism from cyber operations has to say when the characterization is fixed.

Its 6 cross-references, woven across the glossary's 18 categories
TV5Monde attack (2015): Cyber glossary illustration, AlgoPolis
Example

Constructed example: a news channel insured with a cyber terrorism extension suffers sabotage claimed by a jihadist group. The insurer pays the first tranche under the extension. Four months later, the government attributes the attack to a foreign service. The policy carries a state cyber operation exclusion with no clause fixing the characterization: the insurer asks for repayment, and the dispute goes to arbitration.

Read next
CyberFalse flag (cyber)Clues an attacker plants on purpose to put the blame on another actor, which weakens any cover whose outcome depends on who carried out the attack.Read the entry →CyberAPT28 (Fancy Bear, GRU Unit 26165)Cyber espionage group tied by the US, UK and European governments to military unit 26165 of Russian military intelligence: the Bundestag in 2015, the US Democratic Party in 2016.Read the entry →CyberCyberterrorismAn act of terrorism carried out through computer means, a notion with no common legal definition whose treatment depends on what public terrorism schemes say, or leave unsaid.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

TV5Monde attack, TV5Monde 2015, CyberCaliphate

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.