A Valais commune's secretariat mailbox was compromised on 10 August and sat quiet until the attacker used it on 18 August to mail roughly 450 of the commune's own contacts — the send is what triggered detection
The commune of Martigny-Combe, in the Bas-Valais, disclosed on 2026-08-20 that the professional mailbox of its municipal secretariat had been accessed without authorisation. Its own communiqué is brief and gives a detection date — "L'incident a été détecté le 18 août 2026" — the mailbox was blocked immediately, external specialists were engaged, the federal cybersecurity office and the Valais cantonal data protection and transparency commissioner were notified, and a criminal complaint with the Valais cantonal police was recorded as in progress rather than filed (Commune de Martigny-Combe, 2026-08-20).
The part that makes this worth a defender's time is in Le Nouvelliste's reporting rather than the communiqué, and it is attributed to the commune's own external IT-security contractor: "L'entreprise externe gérant la sécurité informatique de la commune a pu identifier que le piratage remontait au 10 août. Une personne avait alors ouvert un mail contaminé reçu sur la messagerie du secrétariat communal, sans s'en rendre compte" — the external firm managing the commune's IT security established that the compromise dated back to 10 August, when someone opened a contaminated email received on the communal secretariat's mailbox without realising it (Le Nouvelliste, 2026-08-20).
That gives the incident a shape worth naming: eight days of access that produced no detectable signal, ended by the attacker's own outbound activity. On 18 August the mailbox was used to send a fraudulent message to roughly 450 people — the commune's own correspondents, receiving mail from a genuine communal address — and it is that send, not any monitoring control, that surfaced the intrusion. The commune president is quoted on the record saying that to the commune's knowledge two recipients had clicked the fraudulent link at the time of reporting. Around 300 emails and their attachments were taken from the mailbox, which he characterises as confidential and in places containing sensitive data; that figure is the newspaper's own count, and the commune's communiqué gives none. The commune says it will maintain a year-long watch for the stolen data appearing online.
L'entreprise externe gérant la sécurité informatique de la commune a pu identifier que le piratage remontait au 10 août. Une personne avait alors ouvert un mail contaminé reçu sur la messagerie du secrétariat communal, sans s'en rendre compte.
L'incident a été détecté le 18 août 2026
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1586.002Compromise Accounts: Email Accounts
Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains).
Initial Access TA0001
T1566Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Collection TA0009
T1114Email Collection
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.