IRIS SDIS 02 operates as the operational extranet for firefighters in Aisne, centralizing the management of interventions, training, and internal documents on a single platform. Its uniqueness lies less in its declared functionalities than in its positioning as a critical digital surface in a department covering more than 800 municipalities, with a mixed workforce of professionals and volunteers whose coordination relies entirely on this tool.
Cyberattack on IRIS SDIS 02: what the July 2026 incident reveals
At the end of July 2026, the SDIS of Aisne was hit by a cyberattack targeting its website and internal digital environment. The Paris prosecutor’s office and the anti-cybercrime office have opened an investigation. The attack was part of a broader campaign affecting several French SDIS, including those in Marne, Alpes-Maritimes, Landes, and Alpes-de-Haute-Provence.
Further reading : The best decor ideas for a cozy home with Breton inspirations
This episode highlighted a blind spot: IRIS is no longer just a management tool but a critical attack surface. When an insulting message was posted on the intranet of the firefighters in Aisne, the compromise directly impacted the agents’ trust in the platform.
Remediation measures were immediate. SDIS 02 imposed a generalized change of IRIS passwords, suspended certain services during the forensic analysis, and modified the access of administrator accounts identified as compromised. Additionally, an internal awareness article reminded agents of several specific rules regarding IRIS: a password distinct from any personal account, immediate change of the temporary password sent via SMS.
Related reading : Everything You Need to Know About the Use and Functioning of a Sitemap for Your Website
We observe that this article detailing the importance of IRIS for the SDIS of Aisne effectively places the tool in its overall operational context, beyond just the security aspect.
Securing the IRIS extranet: regulatory obligations and field practices
The wave of cyberattacks in 2026 accelerated a tightening that had already begun. Decree 2025-1100, which came into effect on July 1, imposes new obligations on operators of establishments receiving the public regarding fire safety registers. For an SDIS, this regulatory constraint is coupled with a compliance requirement on the information systems themselves.
On the ground, securing IRIS involves concrete measures that mainstream articles do not detail:
- Strict separation between IRIS identifiers and any personal or external professional accounts to limit the impact of a data leak by rebound
- Temporary suspension of remote access during an incident, switching to degraded procedures (radio, phone) to maintain operational continuity
- Audit of administrator accounts after each alert, with immediate revocation of suspicious access and enhanced traceability of connections
- Regular awareness training for volunteer firefighters, who represent the majority of the workforce and often connect from personal devices
Cloud compliance and the protection of operational data are becoming structuring topics for SDIS. A compromised extranet is not just a leak of names and phone numbers: it is the coordination capacity of an entire department that can be degraded for several hours.
IRIS as a coordination pivot between rescue centers in Aisne
SDIS 02 covers a vast territory with fire and rescue centers spread throughout the department. IRIS centralizes the tracking of interventions, the management of duty schedules, and the sharing of operational documents between these centers. Without this platform, the pooling of resources between rural and urban centers would be considerably slower.
A concrete example: in July 2026, the SDIS of Aisne sent firefighters to assist during the fires in Gironde. This type of inter-departmental deployment requires real-time management of available personnel, up-to-date qualifications, and authorizations. IRIS allows for quick filtering of deployable agents based on their training, availability, and geographical attachment.
The platform also manages agreements with local authorities and interactions with other fire and rescue services at the regional level. The operational framework of SDIS 02 is based on regulations specifying the conditions for mobilizing resources and personnel, and IRIS serves as its digital arm.
Management of training and monitoring of volunteer firefighters via IRIS
The workforce of SDIS 02 includes both professionals and volunteers. Volunteers make up the vast majority of agents, and their constraints are specific: variable availability, connection from personal devices, and the need for ongoing training tracking remotely.
IRIS handles this aspect by centralizing training paths, certifications, and mandatory refreshers. Each firefighter accesses their individual file, consults their convocations, and validates their achievements directly from the portal. For management, the platform provides a consolidated view of available skills by center, directly informing mobilization decisions.
Identified limits on the ground
The password reset system via SMS, visible on the IRIS login page, raises a question of robustness. In the case of SIM swapping or loss of the phone, the recovery procedure becomes a vector of vulnerability. The cyberattack in July 2026 led the SDIS to review these authentication mechanisms.
The other limit concerns the ergonomics of a portal designed for technical profiles and used by volunteers with very varied digital backgrounds. The adoption curve remains a topic, particularly in rural centers where volunteer turnover is more pronounced.
SDIS 02 is gradually modernizing its rescue means, and IRIS remains at the center of this transformation. The next step will likely focus on strengthening multi-factor authentication and integrating automated response protocols for security incidents, two projects that the 2026 cyberattack campaign has made a priority.