Cyberattacks in Tunisia: the threat landscape and how to respond

Tunisia has a dense digital economy: banks and insurers that went online quickly, a large offshoring and IT services sector, public services moving to e-government, and thousands of SMEs selling through social networks. That makes the country an attractive target, and the attacks we see in the field are the same as everywhere else, with a few local twists.

The threats we meet most often

• Phishing and fraud in local languages. Fake messages from banks, La Poste, delivery companies or the tax office, in French, Arabic and increasingly Tunisian dialect, now written fluently with AI. They target card data, e-banking credentials and one-time codes.
• Business email compromise. A hijacked supplier or executive mailbox is used to change bank details on an invoice. It is cheap for attackers and very costly for victims, especially in import and export.
• Ransomware. Exposed remote access, unpatched VPNs and reused passwords remain the usual entry points. Globally, Verizon finds ransomware in 44% of breaches in its 2025 report, and SMEs are hit as hard as large groups.
• DDoS and defacement. Hacktivist groups regularly target government and media websites around political and regional events. Tunisia has been on that map since “Operation Tunisia” in 2011.
• Third-party risk. Offshoring and IT providers hold access to clients in Europe and the Gulf, which makes them a stepping stone. Verizon reports that third parties were involved in 30% of breaches in 2025, twice the previous year.

A legal framework that is getting stricter

Tunisia was a pioneer: Law 2004-5 made periodic security audits mandatory for many organisations twenty years ago. Decree-Law 2023-17 of 11 March 2023 on cybersecurity replaced the former ANSI with the National Cybersecurity Agency (ANCS), home of the national CERT (tunCERT), and reinforced obligations for operators of critical and vital infrastructure, including risk management, incident reporting and regular audits.

Two other texts matter in daily practice. Decree-Law 2022-54 defines offences related to information systems, from illegal access to data interference. Organic Law 2004-63 governs personal data, under the authority of the INPDP. Banks and insurers add the requirements of their regulators, such as the Central Bank of Tunisia circulars on IT risk.

Local constraints to take into account

Security budgets are tight, especially for SMEs. Skilled profiles are in high demand and many leave for Europe or the Gulf. Legacy systems stay in production for years. And many teams still lack round-the-clock monitoring. None of this is a reason to give up, but it argues for simple, well-run controls and for automation wherever an analyst’s time is scarce.

A 90-day action plan

• Days 1 to 30: close the obvious doors. MFA on email, VPN and admin accounts; remove exposed RDP; patch internet-facing systems; check that backups are offline and that a restore actually works.
• Days 31 to 60: see what happens. Centralise logs (firewall, VPN, Active Directory, email) in a SIEM, deploy EDR on servers and workstations, and set an alert triage process with clear owners.
• Days 61 to 90: prepare and prove. Write an incident response plan with the ANCS reporting steps, run a ransomware tabletop exercise, train teams on local-language phishing and align your evidence with the audit and data protection requirements.

Most successful attacks do not need an advanced attacker. They need one exposed service, one reused password and nobody watching the logs.