SME cybersecurity in New Caledonia: 10 priority measures

On 18 August 2024, the internet provider Lagoon was hit by a ransomware attack. According to Les Nouvelles Calédoniennes (LNC), the local daily, around 40% of its subscribers lost internet access for nearly 48 hours, email was down for two weeks and 850 GB of data were stolen.

Three months earlier, a Caledonian internet provider had already suffered a denial-of-service attack, according to ANSSI, France’s national cybersecurity agency. In October 2026, the manager of the digital cluster Open NC put it this way: since the riots, “we are particularly vulnerable and increasingly targeted”. SME cybersecurity in New Caledonia is no longer a concern for large organisations alone. Here are the measures that matter most, in order of priority.

What the Lagoon attack taught businesses

Business customers were hit too. Around 1% of Lagoon’s professional clients could not reach their hosted servers for three weeks. For a company whose invoicing or customer database runs on those servers, that means three weeks without its working tools.

Three lessons for an SME:

• your provider can be hit: keep a copy of your data somewhere other than with them;
• email is a weak point: plan another way to reach your clients and suppliers;
• the EU’s NIS 2 cybersecurity directive was “not yet applicable in New Caledonia”, LNC noted in October 2024: your protection depends first on your own choices.

The three threats that really affect SMEs

Local data are scarce. In the 2021 digital barometer published by the Observatoire numérique de la Nouvelle-Calédonie, the most recent found, 14% of connected companies said they had already suffered a cyberattack, and only 17% of those had filed a complaint. Only 27% had an off-site backup.

Nationally, cybermalveillance.gouv.fr, the French government’s victim-assistance platform, helped more than 500,000 victims in 2025, 20% more than in 2024. Three threats directly concern an SME:

• phishing: fake messages imitate a bank, a supplier or a colleague, sometimes to get bank details changed; it is the leading threat across all audiences, up 70%;
• account takeover: email or a social media account falls into someone else’s hands, often after phishing; it is the leading threat for professionals, up 45%;
• ransomware: files are encrypted and held to ransom; less frequent, it can halt a business for weeks, as the Lagoon case showed.

SME cybersecurity in New Caledonia: ten priority measures

These measures follow ANSSI’s guide for small and medium-sized businesses and the recommendations of cybermalveillance.gouv.fr. Most of them cost time rather than money.

1. Turn on two-factor authentication for email, online banking and online tools.
2. Use passwords of at least 12 characters, different for each service, stored in a password manager.
3. Install updates as soon as they are offered, and replace equipment that no longer receives them.
4. Back up regularly, with at least one copy disconnected from the network.
5. Give everyone an account without administrator rights, which are kept for configuration.
6. Keep a list of accounts and access rights, and revoke them when an employee leaves.
7. Check any request to change bank details by phone, using a number you already know.
8. Train the team on phishing and give every newcomer an IT charter.
9. Keep antivirus software and a firewall active on every computer.
10. Prepare a one-page incident sheet with the contacts to call.

ANSSI’s starting point is an inventory of your computers, accounts and software: you can only protect what you know you have.

Backups: the measure that saves you

When ransomware strikes, an intact backup makes the difference between a few days of recovery and permanent loss. Attackers also try to destroy online backups, cybermalveillance.gouv.fr warns, so you need a disconnected copy.

ANSSI recommends the “3-2-1” rule:

• three backup copies;
• on two different media;
• one of them offline.

It also calls for regular restore tests. A backup that has never been restored is only an assumption.

BFO Partners’ founder has worked on hosting health information systems since 2011 and ran a New Caledonian cloud operator from 2015 to 2022. The decisive question is not “do we have a backup?” but “how long will it take us to restart?”. Ask your provider, and get the answer in writing.

Training the team on the human factor

After the attack, Lagoon made staff and customer awareness a major line of defence against phishing, LNC reported. Open NC makes the same point: teaching teams to spot suspicious links is a key step.

Useful training stays simple:

• a short session using real messages the company has received;
• a clear rule: reporting a doubt or a mistaken click is encouraged, as ANSSI recommends;
• two-person approval for transfers and changes of bank details;
• a reminder whenever a new employee joins.

Provider, contract, insurance: who does what

Without an IT department, security often rests with an outside provider. The contract should state what they handle and what remains your responsibility:

• who installs updates, and how often;
• where backups are kept, who tests them and how quickly data can be restored;
• response time in case of an incident, including at weekends;
• reversibility: how you get your data back if you change provider.

cybermalveillance.gouv.fr advises choosing providers with recognised expertise, labels or certifications. ANSSI also suggests checking that your insurance policy covers the cyber risks that would hurt the business most, and reading the exclusions.

Reviewing all this before you sign or renew a contract is what a fixed-price diagnostic is for.

The incident response plan

On the day of an attack, nobody has time to look for the right numbers. A printed one-page sheet based on ANSSI’s guidance is enough:

1. Disconnect the affected computers or network from the internet, without switching off or altering the machines.
2. Alert the manager, the IT provider and the insurer.
3. Do not pay the ransom.
4. File a complaint with the police or gendarmerie and keep the evidence. In 2021, only 17% of Caledonian companies that had been attacked had done so.
5. Inform clients and partners if their data are affected. France’s data protection act (loi Informatique et Libertés) applies in New Caledonia: check your obligations with CNIL, the data protection authority.
6. Restart from clean backups, then fix the weakness.

This plan is part of a wider look at digital tools in your business.

Frequently asked questions

What is the first cybersecurity measure for an SME?

Turn on two-factor authentication for email and online accounts, then set up a disconnected backup. Account takeover is the leading threat for professionals in cybermalveillance.gouv.fr’s 2025 report.

What should you do after a ransomware attack?

Disconnect affected computers from the internet without switching them off, alert your provider and insurer, do not pay the ransom and file a complaint. Then restart from clean backups. These are the instructions in ANSSI’s guide for small businesses.

Does an SME need cyber insurance?

ANSSI recommends having your insurance policy assessed for cyber risk. Check whether your current contract covers an attack, business interruption and data restoration, and read the exclusions.

Sources

• Les Nouvelles Calédoniennes, Cyberattaque contre Lagoon : un mois et demi après, que retenir de cette attaque d’une ampleur inédite ?, 02/10/2024
• Europe 1, La Nouvelle-Calédonie visée par une cyberattaque inédite, enquête ouverte à Paris, 22/05/2024
• Les Nouvelles Calédoniennes, « La cybersécurité est vraiment en manque de ressources humaines », 01/10/2026
• cybermalveillance.gouv.fr, Rapport d’activité 2025, 26/03/2026
• Observatoire numérique de la Nouvelle-Calédonie, Baromètre numérique entreprises 2021 (synthèse)
• ANSSI et DGE, La cybersécurité pour les TPE/PME en 13 questions, 2e édition, octobre 2022
• cybermalveillance.gouv.fr, 5 recommandations essentielles pour les entreprises, septembre 2023
• CNIL, Comment la loi Informatique et Libertés s’applique-t-elle à l’outre-mer ?, 04/07/2019