On 3 October 2026, the Hauts-de-France region confirmed the compromise of 782,000 records and 48 GB of sensitive documents (source: FrenchBreaches, data breach observatory, 3 October 2026). Access did not come through a flaw in the region's central infrastructure. It came through two IT suppliers, Atexo and Docaposte, to which the management of business software and document archiving had been delegated. The Resilience Law, placed on the National Assembly's agenda for 7 October, will concern around 1,500 local authorities (source: National Assembly legislative file, special committee, report no. 1, October 2026). This timeline calls for a precise reading of what the text requires in terms of governance of digital suppliers.
What the attack reveals structurally
Atexo publishes software for public authorities: public procurement, human resources, management of grants. Docaposte, a subsidiary of La Poste, manages the digital transformation of many public bodies. These two suppliers had direct access to the region's databases, without a security barrier equivalent to that of the central infrastructure.
This pattern is not specific to Hauts-de-France. Most French local authorities simultaneously manage several dozen specialist IT suppliers: one publisher for payroll, another for school tracking, a third for land management. Each has direct access to a segment of data. None is subject to the same security requirements as the client entity.
The real attack surface of a local authority is not the infrastructure it administers directly. It is the set of access rights granted to its suppliers.
What the Resilience Law will concretely require
The draft law on the resilience of critical infrastructure and the strengthening of cybersecurity transposes, among other things, the NIS2 Directive. It is being examined in public session at the National Assembly from 7 October 2026. Around 1,500 local authorities will be concerned, including the 300 communes with more than 30,000 inhabitants and their groupings.
For these entities, the law will introduce obligations directly applicable to the relationship with IT suppliers. The provision corresponding to Article 21 of the NIS2 Directive requires that the information systems security policy include security of the digital supply chain. In practice, this means three distinct obligations.
First, local authorities will have to map the suppliers that have access to their information systems. This mapping must identify the nature of the access, the data to which the supplier can access, and the level of security it applies.
Second, they will have to include security clauses in public IT contracts. New procurement procedures will need to assess the cyber maturity of candidates. Ongoing contracts will have to be renegotiated or supplemented by amendment.
Third, when an incident involves a supplier, the local authority remains responsible for notifying ANSSI (France's national cybersecurity agency). The fact that the initial access was gained through a third party does not shift that responsibility. Notification must be made within 24 hours of becoming aware of the incident, whatever its source.
The Hauts-de-France sequence: two practical questions
The region learned of the incident through its own monitoring teams, not through a report from Atexo or Docaposte. The suppliers, once alerted, shut down the platforms concerned. Users began to be informed by email.
This sequence raises two practical questions. The first: how much time elapsed between the compromise and detection? If that delay exceeds 24 hours, the authority may be outside the NIS2 notification deadline, counted from the moment it should have become aware of the incident. The second: did the contracts with Atexo and Docaposte include an obligation to notify immediately in the event of suspected compromise? Without that clause, the authority depends on its suppliers' diligence to trigger its own regulatory procedure.
This kind of contractual vulnerability is not an exception. In the private sector, software supply chain attacks on security vendors show the same vector: a supplier with privileged access, no contractual obligation to report immediately, and a client organisation that detects the incident independently. For local authorities, the burden is all the heavier because they also process personal data of residents subject simultaneously to Article 33 GDPR.
Three measures before the law is adopted
Establish an inventory of supplier access to your systems. Every IT supplier with direct access to your databases, file systems or administration interfaces must appear in a register. For each entry: nature of the access, data exposed, authentication mechanism used, date of the supplier's last security audit. This inventory is the starting point for any supply chain policy compliant with the obligations to come.
Insert an immediate notification clause into your ongoing contracts. This clause requires the supplier to notify you within a defined period, twenty-four hours at most, of any suspicion of unauthorised access to your data or systems. It must also require the supplier to cooperate with your notification procedure to ANSSI. An amendment is possible for ongoing contracts. For new tenders, the clause must appear in the specifications.
Test your notification procedure with a supplier scenario. Most incident simulation exercises assume that detection happens internally. The scenario of a compromised supplier, in which the authority learns of the incident through its own detections, should be part of your exercise programme. This test will check whether your team knows how to qualify an incident it did not originate directly and when to start the notification clock.
What the legislative timetable requires
The Resilience Law is in public session on 7 October. Its probable adoption before the end of October 2026 will start a compliance period whose precise length will be set by the final text. The gap between entry into force and the first effective obligations will be short for local authorities that have not started.
Mapping suppliers and revising contracts are not tasks that can be completed in a few weeks. Public procurement has its own procedural timeframes. A local authority that starts this inventory today will be in a very different position from one that waits for the final adoption of the text.
The Hauts-de-France incident will not be the last of its kind. It illustrates an attack surface that the regulation now being adopted will make explicitly enforceable.