the director-general of tv5monde, yves bigot, later said that the attack nearly destroyed the company; if it had taken longer to restore broadcasting, satellite distribution channels would have been likely to cancel their contracts. the attack was designed to be destructive, both of equipment and of the company itself, rather than for propaganda or espionage, as had been the case for most other cyber-attacks. the attack was carefully planned; the first known penetration of the network was on january 23, 2015. the attackers then carried out reconnaissance of tv5monde to understand the way in which it broadcast its signals, and constructed bespoke malicious software to corrupt and destroy the internet-connected hardware that controlled the tv station's operations, such as the encoder systems. they used seven different points of entry, not all part of tv5monde or even in france—one was a company based in the netherlands that supplied the remote controlled cameras used in tv5's studios. between february 16 and march 25 the attackers collected data on tv5 internal platforms, including its it internal wiki, and verified that login credentials were still valid. during the attack, the hackers ran a series of commands extracted from tacacs logs to erase the firmware from switches and routers.