LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

Ransomware at the syndic and the leak of co-owners’ data

Buildings and co-ownership 11 min Author : Arnaud Colin Updated : 19/09/2026

Summary

When its manager is encrypted, a co-ownership loses its e-mail, its rental deposit refunds and its files for weeks, and its co-owners’ data are threatened with publication, and sometimes published, if the ransom is refused. DBS Group, Oralia, Encevo and Vivalia bring out what makes recovery possible: tested offline backups, separated networks and prepared communication. A leak does not need a hacker: SERGIC was fined €400,000 for a web-address flaw, and a Luxembourg syndic €1,500 by the CNPD for a group e-mail.

A syndic or building manager holds, for each client it acts for, what an attacker is looking for: identity documents, bank details, leases, minutes, statements of account. When its IT is encrypted by ransomware, the building still stands, but its management stops: e-mail cut off, rental deposits not refunded, files to be rebuilt. When those data leak, it is the co-owners and tenants who bear the consequences. What happens to a co-ownership when its manager is encrypted or its data leak, and who pays? Six documented cases, in Switzerland, France, Belgium and Luxembourg, make it possible to answer without extrapolating.

DBS Group, French-speaking Switzerland, 2021: the encrypted property manager that refuses to pay

On the morning of 2 December 2021, an employee of DBS Group, a Foncia subsidiary that brings together twelve property management brands in French-speaking Switzerland, including Domicim and Brolliet, opens an infected attachment and reports it at once. The report stops nothing: the servers are encrypted and data are exfiltrated, according to RTS and ICTjournal. The group has around forty branches and more than 700 employees, for an IT team of around fifteen people.

E-mail is cut off, the agencies run at reduced pace, employees are left without work and at least one outgoing tenant’s rental deposit could not be refunded. Management refuses to pay, on the advice of the police, who point out that paying in no way guarantees the criminals’ cooperation; a complaint is prepared in the canton of Vaud. On the evening of Monday 13 December, the attackers publish around 750 MB, presented as a 5% sample: leases, contracts, quotes, payment slips with bank details, rental deposits, internal e-mails, plans and spreadsheets, with names, addresses, signatures, rent amounts and sometimes number plates, across all the French-speaking cantons (RTS Geneva). The paralysis was expected to last until mid-January 2022; in the meantime, clients were referred to the telephone.

Oralia and Happy-Immo, France, 2022-2023: the large group and the small agency

On Wednesday 20 April 2022, Oralia, a property management company and Nexity subsidiary, detects an attack on its network and warns its clients the same day, in an e-mail from its chief executive, with a simple instruction: “do not send any data by e-mail” (LeMagIT). E-mail is restored on 22 April. Between 24 and 27 April, the Black Basta group, which emerged that same month according to CISA advisory AA24-131A, claims the attack and puts around sixty gigabytes online, 63 GB according to ZATAZ: copies of identity cards, Vitale health insurance cards, internal documents and a map of the information system. The point of entry has not been made public.

The communication went out immediately, through a channel that was not the compromised e-mail system, with a ban on sending data by e-mail during the crisis. And Oralia’s servers were isolated from Nexity’s: no spread to the parent company was feared. The client portal remained inaccessible for several days, and the people whose documents were published remain exposed to targeted phishing.

A much smaller agency went through the equivalent almost a year later. On 10 March 2023 at 5.36 am, ransomware enters Happy-Immo through a workstation connected to the server; 450 client files are deleted. The ransom of €100,000, later lowered to €10,000, is not paid. The agency spends a week without activity, mobilises its 85 employees, files a complaint and reports the incident to the CNIL and ANSSI; by the date of the France 3 Hauts-de-France report, on 16 March 2023, around a hundred files had been rebuilt by hand.

Encevo, Creos and Enovos, Luxembourg, 2022: the portals hit, the supply spared

During the night of 22 to 23 July 2022, the Luxembourg entities of the Encevo group, an electricity and gas operator, including Creos and Enovos, suffer a cyberattack. The press release of 25 July, reproduced on Encevo’s dedicated page, announces disrupted customer portals, a crisis unit and an essential clarification: the supply of electricity and gas is not affected, and the breakdown service continues to operate. On 28 July, the group confirms that a certain amount of data has been exfiltrated (BleepingComputer). On Saturday 30 July, the ALPHV/BlackCat group adds Creos to its extortion site and threatens to publish 180,000 files, or 150 GB: contracts, agreements, passports, invoices, e-mails (Le Quotidien, Paperjam). These volumes are those of the claim; neither the ransom amount nor the entry vector has been disclosed.

Creos then had some 300,000 electricity customers and 49,000 gas customers, according to Le Quotidien. The response followed a clear order: a complaint to the Grand Ducal Police, notification to the CNPD, the ILR and the relevant ministries, analysis of the exfiltrated data in order to inform the people concerned, and advice to customers to change their credentials, including elsewhere if they reused the same password. The press release itself distinguishes the information system and the portals, which were hit, from physical operations, which were spared: nothing indicates that any meters were reached.

Vivalia, province of Luxembourg, 2022: an entire building goes back to paper

This case is not that of a syndic, but it shows what ransomware does to an entire building without touching its technical installations. During the night of Friday 13 to Saturday 14 May 2022, shortly before 3.30 am, ransomware is detected on the network of Vivalia, a group of care establishments in the province of Luxembourg, in Belgium, a few kilometres from the Grand Duchy’s border: six hospital sites, a polyclinic, four nursing and care homes, a psychiatric care home and three crèches, for 47 affiliated municipalities, according to the statement reported by the Belgian press on 14 May. Around 200 servers and 1,500 computers are affected; consultations, non-urgent operations and imaging examinations are cancelled, and patient records are kept by hand. On 18 May, the LockBit group claims the attack and sets an ultimatum for 26 May; on that day, the threat of publication is withdrawn without any publication being known, and without any payment ever having been confirmed. Recovery at four sites does not come until 28 June, around six weeks later (CERT Santé).

The case was taken up by the Belgian federal prosecutor’s office. Teams from CERT.be came on site; the instruction not to pay was reiterated and workstations without any external connection were redeployed in the priority departments. A deficit of around €9.7 million was reported at the end of June 2022, a figure that could not be cross-checked against the accounts. For a residence, the point to remember is time: six weeks in degraded mode.

SERGIC and a Luxembourg syndic: the leak without a hacker

The last two cases have no attacker: a leak does not need ransomware, and, in the SERGIC case, the CNIL did not have to demonstrate that a third party had accessed the data in order to impose a sanction; the accessibility and the slowness of the fix were enough.

In March 2018, a flaw is reported to SERGIC, a French property management company that is also a co-ownership syndic: the documents uploaded by prospective tenants to its website can be accessed by changing a number in the document’s address, without any authentication. A complaint reaches the CNIL on 12 August 2018; during the inspections of 7 and 13 September, the delegation downloads 9,446 documents and finds that 290,870 files are accessible: identity cards, Vitale health insurance cards, tax notices, death and marriage certificates, divorce judgments, bank statements. The fix only takes effect on 17 September 2018, six months after the report. In its deliberation SAN-2019-005 of 28 May 2019, the CNIL imposes a fine of €400,000 and orders its publication: a breach of Article 32 of the GDPR, authentication being described as a basic measure, and of Article 5(1)(e), the files of unsuccessful applicants being kept without limit when they may not be kept for more than three months in the active database after the property has been allocated. The Conseil d’État dismissed the appeal on 4 November 2020: the CNIL may find a flaw online without prior warning and impose a sanction without a prior formal notice. The GDPR applies in the same way in Luxembourg.

In Luxembourg specifically, the CNPD’s deliberation No. 18FR/2022 of 13 December 2022 concerns a syndic. On 11 February 2019, the syndic sends six recipients a reminder of amounts owed with, as attachments, two letters setting out the individual statements of account for 2018 and 2019 and the private address of two co-owners: names, monthly movements and debit balances, read by their neighbours. On 13 February the two co-owners request access to their data; on 16 April they receive only an incomplete information note. The syndic relied on the Grand Ducal regulation of 13 June 1975; the CNPD finds breaches of Articles 5(1)(a) and 6(1) of the GDPR (lawfulness of the disclosure) and of Articles 12(3), 12(4) and 15(1)(b) and (c) (right of access), which it holds were not deliberate. The fine is €1,500, without a corrective measure since the syndic no longer holds a mandate; it had stopped responding to the authority after 29 July 2020. The procedure lasted almost four years, and the decision, anonymised, is public.

The amount is small; what weighs, for a syndic, is that every co-owner received the e-mail. A co-owner’s statement of account is personal data: the reminder of amounts owed goes to the debtor alone, and an access request receives its reply within the month.

What this teaches a building or co-ownership in Luxembourg

The steps these six cases suggest are a matter of co-ownership governance more than of IT.

  • Choosing the manager is a governance decision. The building inherits its provider’s weaknesses, as Creos’s customers inherited their operator’s. Before signing or renewing a mandate, ask the syndic where the co-ownership’s data are hosted, who backs them up and, if it belongs to a group, whether its servers are isolated from the group’s, as Oralia’s were from Nexity’s.
  • A tested offline backup is what makes recovery possible. At DBS Group, the immediate report did not prevent encryption; at Happy-Immo, the 450 deleted files had to be rebuilt by hand, and only around a hundred had been six days later. The useful question is not “do you have backups?” but “when did you last restore?”.
  • Separate office IT from operations. Encevo’s press release distinguishes the portals, which were hit, from the energy supply, which was spared. The same principle applies between the syndic’s workstation and the building’s technical management: heating, doors, cameras.
  • Keep only what is necessary. Passports at Encevo, identity cards at Oralia, files of unsuccessful applicants at SERGIC: what is not kept cannot leak, and unlimited retention is in itself a breach that is sanctioned.
  • A group e-mail commits the whole residence. The reminder of amounts owed goes to the debtor alone; what applies to the accounts applies to notices of meetings and minutes, and the end of the mandate does not erase liability.
  • A reported flaw triggers a dated fix. At SERGIC, six months between the report and the fix weighed in the sanction. Ask the publisher of the co-owners’ extranet whether a document can be reached by changing a number in the address.
  • Prepare the communication and the position on the ransom. Oralia warned its clients the same day, outside the compromised e-mail system. A syndic must know through which channel it will reach its co-owners if its e-mail goes down, and decide in advance whether it will pay; the police, in the Swiss case, recommended not doing so, and the same instruction was reiterated in the Belgian case.
  • Notify quickly, then warn the co-owners before the fraudsters do. The GDPR allows 72 hours to notify the authority (Article 33) and requires the people concerned to be informed without undue delay (Article 34). The data published after DBS Group and Oralia are what is needed for a bank transfer fraud: after a leak, clients must know that any change of bank details is verified through another channel, and must change their credentials, as Encevo advised its customers.

Sources