Ransomware in France: understanding the threat, preparing, responding

Key takeaways

• In 2025, ANSSI (ANSSI, France's national cybersecurity agency) was made aware of 128 ransomware compromises in France. That is slightly fewer than in 2024. SMEs, very small businesses and mid-sized companies (ETI) remain the hardest hit, ahead of local authorities and healthcare institutions.
• Ransomware is no longer just about encryption. Attackers also steal data and threaten to publish it: this is double extortion. Some groups even limit themselves to data theft.
• In 2025, the strain most observed by ANSSI was Qilin (21% of cases), ahead of Akira and LockBit. As of early fall 2026, Qilin remains among the most active groups.
• The most common entry points are internet-exposed access services: poorly protected or unpatched VPNs, remote desktop, firewalls, NAS devices and hypervisors.
• Authorities advise against paying the ransom. Several obligations do apply, however: filing a police report within 72 hours to be compensated by your insurer, and notifying the CNIL (the French data protection authority) within 72 hours if personal data is affected.
• If you are attacked, free help is available: 17Cyber, cybermalveillance.gouv.fr, regional CSIRTs and, for the most critical entities, ANSSI.

What are we talking about?

According to ANSSI, ransomware is malicious code that prevents the victim from accessing their files, usually by encrypting them. The attacker then offers to provide a way to recover them in exchange for a ransom payment.

Double and triple extortion

Attackers no longer just lock systems. Before encrypting, they copy the victim's data, then threaten to leak it. This is double extortion. Triple extortion refers to pressure that goes further: a distributed denial-of-service (DDoS) attack against the victim, or blackmail aimed at its customers and partners. ANSSI also notes that some groups practice extortion without ransomware, using stolen data alone. This trend remains limited among the incidents the agency handled in 2025. However, the data exfiltration incidents reported to the agency rose from 130 in 2024 to 196 in 2025.

Ransomware as a service

Most major groups operate like franchises, following the ransomware-as-a-service (RaaS) model. An "operator" develops the software and the infrastructure (extortion site, negotiation). It makes them available to "affiliates" who carry out the attacks and pay the operator a percentage of the ransoms. According to ANSSI, franchises such as Akira, Inc Ransom and Qilin have succeeded in retaining their affiliates and maintaining a high level of activity. This model explains why arresting one member is not enough to make a group disappear: see the case of an alleged Qilin member arrested in Japan and handed over to Germany.

Access brokers

Upstream, initial access brokers (Initial Access Brokers, IABs) resell access to corporate networks or stolen credentials. These credentials are often collected by infostealers, spyware that harvests passwords saved in browsers. ANSSI describes these brokers as essential intermediaries in the ransomware ecosystem. The practical consequence: an attack can start with a single password stolen from a personal computer, weeks before the encryption.

The threat in numbers

According to ANSSI (2025)

The Panorama de la cybermenace 2025 (2025 Cyberthreat Overview), published on March 11, 2026, highlights the following points:

• 128 ransomware compromises reported to the agency, compared with 141 in 2024.
• SMEs, very small businesses and mid-sized companies remain the most affected category.
• The share of healthcare institutions is rising again (8%). It includes hospitals, but also nursing homes (EHPAD) and clinics.
• The share of local authorities falls to 11%, compared with 17% in 2024.
• Schools, particularly primary and secondary schools, were especially hard hit. Some had to operate in degraded mode for several weeks.
• The most represented strains are Qilin (21%), Akira (9%) and LockBit 3.0 (5%). More than a dozen new strains were observed for the first time, including Nova, Warlock and Sinobi.

These figures only cover incidents reported to ANSSI: they do not measure all attacks in France. The agency also reports several ransomware attacks against industrial defense subcontractors in the first half of 2025. It also notes encryption of cloud-hosted resources: a single compromised provider can then affect many customers.

According to cybermalveillance.gouv.fr (2025)

The national victim assistance service received 2,700 assistance requests related to ransomware in 2025, across all audiences (+10%). Of these, 1,691 came from professionals (+7%). According to its activity report, after a lull in 2024, attacks have reached their highest level for the second time in five years. The report sees this as the start of a possible resurgence.

• Businesses and nonprofits: 4th most common reason for requesting assistance (8.1%), up about 9%.
• Local authorities and government bodies: 3rd most common reason (13.1%), with a nearly stable volume (+1%).

For professionals, the attack most often results from an intrusion. It exploits a flaw in external access points or exposed services (RDP remote desktop, VPN, NAS), in edge devices (firewalls, gateways) or in virtualization software.

Recent trends (2026)

There is no official 2026 assessment yet. According to tracking by LeMagIT, based on claims by groups and cases reported in the press, more than 920 incidents were recorded worldwide in July 2026, and as many in August. That is the highest level since the tracking began in 2020. In France, the threat remains high, with a peak in March 2026. According to the same tracking, Qilin and The Gentlemen are the most active groups, while Akira has been declining since the start of the year.

The Palo Alto GlobalProtect vulnerability CVE-2026-0257, patched in May, illustrates this pattern. According to ReliaQuest, it is still used as an entry point by the Qilin and Settra groups.

Who is affected?

Every organization is. ANSSI stresses that ransomware targets most sectors and regions “indiscriminately”: attacks are above all opportunistic. Attackers look for a vulnerable access point, not a particular victim. A few recent examples:

• the town of Tarnos (Landes), whose email system has been targeted since August 27, 2026; the mayor confirmed a ransom demand (source: LeMagIT);
• the Maison du souvenir de Maillé, a memorial site hit on September 10, 2026;
• in Europe, the attack on Collins Aerospace in September 2025, claimed by the Everest group. According to ANSSI, it disrupted several European airports for several days.

Service providers are a weak point. In October 2026, in Japan, an attack on the hosting provider IDCF Cloud affected 495 customers, including local authorities. Customers were asked to rebuild their systems from their own backups.

Should you pay?

No. This is the consistent position of ANSSI and cybermalveillance.gouv.fr. Their reasons:

• paying guarantees neither that you will recover your data, nor that the stolen data will not be published;
• the victim may be attacked again, or receive a higher demand;
• the ransom funds criminal groups and their next attacks.

Payment is not prohibited as such in France. But the only solid protection remains being able to restart without the attackers, thanks to clean backups. The negotiation ecosystem is itself under investigation: the cofounder of a ransom negotiation firm was arrested in the United States in October 2026. They are presumed innocent.

Your obligations

File a police report, within 72 hours if you are insured

Since the Interior Ministry's orientation and programming law (LOPMI) of January 24, 2023, Article L. 12-10-1 of the French Insurance Code governs compensation for cyberattacks. To be compensated, the victim must have filed a report no later than 72 hours after becoming aware of the attack. The rule applies to legal entities and professionals. Filing a report is a necessary condition, but it is not sufficient: the contract determines what is covered. The report can be filed at a police station or gendarmerie, or in writing to the public prosecutor. Cybermalveillance.gouv.fr recommends filing it before reinstalling machines, to preserve evidence. Also remember to report the loss to your insurer.

Notify the CNIL

Ransomware almost always affects personal data: staff, customer or user files. This then constitutes a data breach. The data controller must notify it to the French data protection authority (CNIL) without undue delay and, where possible, within 72 hours (Article 33 of the GDPR, the General Data Protection Regulation). An initial notification can be supplemented later. If the risk is high, the individuals concerned must also be informed. In all cases, the incident must be documented internally.

Other reporting duties

Regulated operators, healthcare institutions and government bodies may have sector-specific reporting obligations. Check which ones apply to you. The upcoming framework stemming from the EU NIS2 directive will extend reporting obligations to many entities. See our guide on NIS2.

Timeline and milestones

• September 4, 2020: publication of the ANSSI and Ministry of Justice guide “Attaques par rançongiciels, tous concernés” (Ransomware attacks: everyone is concerned).
• April 24, 2023: the obligation to file a report within 72 hours to qualify for insurance compensation comes into force (LOPMI).
• October 17, 2024: deadline for transposing the NIS2 directive, which France missed.
• December 17, 2024: launch of 17Cyber.
• March 11, 2026: publication of ANSSI's 2025 Cyberthreat Overview.
• March 2026: 2025 activity report from cybermalveillance.gouv.fr.
• May 7, 2026: update of the “Rançongiciel” quick-reference sheet from cybermalveillance.gouv.fr.
• October 2026: the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS2, was adopted by the Senate on March 12, 2025. Its examination in the National Assembly, scheduled from October 7, 2026, was postponed on October 6 by the Conference of Presidents, with no new date. As of October 12, 2026, it has not been enacted.

Where to start

Before: reduce the risk

1. Back up, including an offline copy. Make regular backups, keep at least one copy disconnected from the network, and test restoration. Attackers first try to destroy backups. If you are hosted by a provider, do not rely solely on its snapshots.
2. Prioritize updating what is exposed to the internet: VPNs, firewalls, email, remote access, NAS devices, hypervisors. After a critical vulnerability, applying the patch is not always enough: also check that no suspicious access took place before the update.
3. Enable multifactor authentication (MFA) on all remote access (including remote maintenance by providers), on email and on online services.
4. Limit privileges. No administrator account for everyday use. Administer from dedicated workstations. Change default passwords.
5. Equip workstations and servers with antivirus or a detection tool (EDR). Keep activity logs.
6. Train your teams to spot phishing and to know who to alert.
7. Prepare for a crisis. Keep an up-to-date contact list (provider, insurer, 17Cyber, regional CSIRT), a printed quick-reference sheet and a business continuity and recovery plan (BCP/DRP). Review your insurance contract.

During: contain without destroying evidence

1. Isolate: cut off internet access, and disconnect the affected machines and any connected backups from the network.
2. Do not shut down the affected machines: their memory contains evidence. If encryption is in progress, prefer hibernation. Do not turn on machines that have been shut down whose data may have been spared. ANSSI cites the case of an entity that cut the power to its data center: the result was several weeks of downtime and the loss of traces useful to the investigation.
3. Alert: your IT provider, 17Cyber or your regional CSIRT. Critical entities alert ANSSI.
4. Manage the crisis: set up a crisis team, keep a time-stamped log of actions and prepare internal and external communications.
5. Preserve evidence: logs, ransom note, encrypted files, disk copies.
6. Report: police report within 72 hours, notification to your insurer, notification to the CNIL if personal data is affected. Do not pay.

After: rebuild cleanly

1. Identify the entry point and fix it before putting anything back into service.
2. Look for traces left by the attacker: created accounts, scheduled tasks, unknown programs.
3. Check on No More Ransom (Europol) whether a decryption tool exists.
4. Reinstall systems and restore from a clean backup that predates the intrusion.
5. Change all affected passwords and update everything.
6. Resume activity gradually, under heightened monitoring, then hold a post-incident review.

Further resources

• 17Cyber (17cyber.gouv.fr): online diagnosis and advice, available 24/7. The service is provided by the National Police, the National Gendarmerie and cybermalveillance.gouv.fr. Depending on severity, a chat with a police officer or gendarme is possible. In a life-threatening emergency, call 17 or 112.
• Cybermalveillance.gouv.fr: “Rançongiciel” quick-reference sheet, and referrals to accredited providers (ExpertCyber).
• Regional CSIRTs: free incident response centers for businesses, local authorities, nonprofits and mid-sized organizations. They assess the incident and refer you to trusted providers. Their contact details are on your region's website.
• ANSSI (cyber.gouv.fr): Cyberthreat Overview, the guide “Attaques par rançongiciels, tous concernés,” and support for critical entities.
• CNIL: online service for notifying data breaches.