Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
FR #6 most targeted country

Ransomware attacks in France

567 organisations in France have been listed on ransomware leak sites, ranking #6 worldwide. Updated .

Victims
567
2.4% of global total
Global rank
#6
of 180 countries
Active groups
95
Most: Qilin
Sectors
20
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in France. Figures are computed from the tracked records, not inferred.

France recorded ransomware attacks against 566 victims according to recent data; among the most targeted are groups like Qilin and Thegentlemen.

France in the global picture

France accounts for 567 of the ransomware disclosures tracked here, ranking #6 worldwide and making up 2.4% of the global total. The sectors listed most often are Business Services, Technology, Manufacturing.

Who is most active in France

Qilin — 111 victims in France. Qilin ransomware was first observed in July of 2022. Thegentlemen — 42 victims in France. 8base — 24 victims in France. The 8base Ransomware group made its first appearance in early March 2022, remaining somewhat quiet after the attacks.

Where to report an incident in France

National computer emergency response teams for France, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: France

France ranks #6 worldwide for ransomware disclosures, with 567 victims in this database — 2.4% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and 8base.

The most frequently listed industries in France are Business Services, Technology, Manufacturing. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

As a major economy with many large enterprises, France is a consistent target for groups seeking large payments. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in France 567

Page 1 of 6
Organization Disclosed
MECA-PRECIS
Lamashtu
saintpierredescorps.fr
Lockbit5
Valode & Pistre
Panzer
SON-VIDEO
Majinahanashi
Mabris
Thegentlemen
SAS H2O MICHEL
Thegentlemen
Boullard Musique
Payload
SOCOCO
Umbra
RÉSO
Dragonforce
euroditel.com
Krybit
euroditel.com
Krybit
www.pierrefeu.fr
Krybit
www.pierrefeu.fr
Krybit
EURODITEL/RESOTELECOM
Krybit
EURODITEL/RESOTELECOM
Krybit
Europrim
Thegentlemen
FIDUCIAL
Lamashtu
FIDUCIAL
Lamashtu
Le Centre National de l'Expertise Hospitalière (CNEH)
Kairos
Le Centre National de l'Expertise Hospitalière (CNEH)
Kairos
Ressources Si
Panzer
Ressources Si
Panzer
agiliance.fr
Zawoo
Agora coopérative agricole
Qilin
amb-pvc.com
Zawoo
amb-pvc.com
Zawoo
BMGP Groupe
Dragonforce
BMGP Groupe
Dragonforce
www.francare.com
Zawoo
www.francare.com
Zawoo
Aokkef
Medusalocker
Aokkef
Medusalocker
ambpvc
Zawoo
FRANCARETRAD
Zawoo
HEOLIS
Zawoo
Stim
Panzer
Stim
Panzer
Thema Foundries
Qilin
Aforpa
Thegentlemen
Aforpa
Thegentlemen
Rosello et Fils
Eclipse
Rosello et Fils
Eclipse
CARIDRO VAL DE LOIRE
Qilin
CARIDRO VAL DE LOIRE
Qilin
eracm.fr
Krybit
Financière d'Uzès
Panzer
Financière d'Uzès
Panzer
SAD'S Interim
Rhysida
Jouvet SAS
Qilin
Jouvet SAS
Qilin
Ville de Libercourt
Kairos
Ville de Libercourt
Kairos
www.alphaplantes.com
Krybit
La Maison Des Travaux
Qilin
Netim Company
Dysphor1a
OTEIS Conseil & Ingénierie
Coinbasecartel
Geb Sas
Thegentlemen
ProSim Aviation Research
Direwolf
Capgemini Engineering
Everest
Experts Entreprendre
Everest
Philippe Hottinguer Finance
Qilin
actua.fr
Lockbit5
Bija Industrie
Medusalocker
dupouy-associes.fr
Lockbit5
Jone Précision
Qilin
NUVITIA.COM
Clop
SON-VIDEO
Majinahanashi
Impact Centre Chrétien
Qilin
bouygues-es.fr
L group
MEDICOS
Bravox
reflet2000.fr
Krybit
www.actini.com
Krybit
www.ernat-bureau-etudes.fr
Krybit
ALIZE (alize-sud.fr)
Qilin
Stade Francais
Qilin
setic-pourtier.com
Lockbit5
Mairie de Drancy
Qilin
Questel SAS
Shinyhunters
www.ville-rinxent.fr
Krybit
Prelys Courtage
Anubis
Diffusion de Produits Inoxydables
Nightspire
Groupe Fenwick
Qilin
Savills France
Qilin
****.fr
Section9
Decoupe Laser Services
Thegentlemen
Gloria Maris Groupe
Thegentlemen
SICSOE
Thegentlemen
La Financière d'Orion (finorion)
Nova
La Financière d'Orion (finorion)
Nova
Armara
Qilin
Armara
Qilin
Terra Vitis
Thegentlemen
Vignobles Toutigeac
Thegentlemen
Distribox
Arcusmedia
Cemoi
Qilin
Carita
Thegentlemen
hotel-bourse.com
Lockbit5
The commune of Castries
Payload
Ce Ratp Comite D entreprise Ratp
Thegentlemen
Spedidam
Thegentlemen
1–100 of 567

Frequently asked questions

How many ransomware attacks have occurred in France?

France has recorded 567 ransomware victim disclosures in this database, ranking #6 globally. This represents 2.4% of all tracked ransomware attacks worldwide.

Which ransomware groups target France?

The ransomware groups most active in France are Qilin, Thegentlemen, 8base, Lockbit3. These groups collectively account for the majority of victim disclosures attributed to France.

Which industries are most targeted by ransomware in France?

In France, the most frequently targeted sectors are Business Services, Technology, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does France rank globally for ransomware attacks?

France ranks #6 globally for ransomware attacks with 567 victim disclosures, representing 2.4% of the worldwide total of 23,585 tracked victims.

How can organisations in France protect against ransomware?

Organisations in France should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting France is also recommended.