Surge in Cyber Threats Targeting France: Data Leaks and Ransomware Rise

Over the past 24 months, France has experienced a significant increase in cyber threats, including 17,800 instances of data leaks, credential dumps, ransomware advisories, and hacktivist activities. Monthly dark-web activity surged from under 300 to over 1,400 in January 2026, maintaining a plateau above 1,000. The government sector is the most affected, with 1,652 incidents, followed by financial services and technology. Ransomware attacks primarily target local governments and SMEs, while hacktivism is led by the pro-Russian group NoName057(16). The CNIL has imposed over EUR 1 billion in fines, reflecting a shift towards punitive enforcement for security failures. Key vulnerabilities include inadequate authentication and excessive access scope, which have been cited in recent sanctions. The overall trend indicates a structural increase in the underground economy surrounding French data.

Key Points: • France has seen over 17,800 cyber incidents in the last 24 months, with a notable rise in dark-web activity. • Ransomware attacks are primarily targeting local governments and SMEs, with significant financial penalties imposed by CNIL. • Hacktivism activities are dominated by the pro-Russian group NoName057(16), indicating geopolitical motivations.