Ransomware and Data-Theft Claims in France: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in France, and for any group that operates in both France and the Gulf.

1. In our tracking, France shows more than twice the claims of all six Gulf markets combined. We observed 185 France-linked claims in the first nine months of 2026, against 83 across the six Gulf markets, split 66, 57, and 62 by quarter. These are observed volumes in our collection, not an exhaustive or directly comparable measure of real incidence. The tracker's raw yearly counts, taken before deduplication and on an uneven collection record in earlier years, are 110 for 2023, 130 for 2024, 187 for 2025, and 200 so far in 2026, so they do not establish a reliable year-on-year trend.
2. Two brands make two-fifths of the claims. Qilin made 42 (23%) and The Gentlemen 34 (18%). The ANSSI, France's national cybersecurity agency, reports Qilin as the most represented strain in its 2025 ransomware incidents, at 21%. The two sources point to a prominent Qilin presence, though the period, measure, and counting method differ. Behind them sit 40 groups, 23 of which appear only in France.
3. The victims are small firms, advisers, and local authorities. Professional services lead with 38 claims, including nine accounting and law practices from nine different groups, and 12 communes and communities of communes appear. Household-name organizations are a minority of the list, and several of their listings come from data-theft groups with thin evidence.
4. The same groups work France and the Gulf. Nineteen of the 42 French groups also posted Gulf victims in the same period, and they made 143 of the 185 French claims (77%). Krybit has six France-linked claims and six in the Gulf: five in the UAE and one in Saudi Arabia. The overlap supports shared threat monitoring across both regions, but shared group names do not prove shared affiliates, infrastructure, or techniques, so technical controls should follow each observed campaign.
5. The forum market is a mass of small public-sector and consumer dumps. One tracker counts 1,369 French-targeted forum posts across its history, and the five most active handles made 18% of them. In the first ten days of October the posts we captured offer tens of thousands of records at a time. ANSSI warns that claimed data may come from old leaks, so each listing is a verification task.

We rate the risk to French small and mid-sized firms, and to local authorities, as High and steady. For accounting and legal advisers, healthcare, and education we rate it Elevated, because they hold other organizations' files. These are our assessments, built on leak-site claims that no one has verified.

1. Scope, and what the numbers can bear

This report covers claims naming French organizations that were published on leak sites between 1 January and 30 September 2026. Claims dated in October are cited separately as a later development. The tracker lists 200 such entries. After removing duplicates and organizations headquartered elsewhere, 185 remain. We count the same domain or organization name listed again within 14 days, by the same or another group, once. This rule can merge genuinely separate incidents at one organization, so a repeated listing counts as one claim and not as proof of one incident. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, so a multinational is counted in France only when its headquarters or main operations are there. The tracker’s company descriptions are sometimes generated automatically, and we have not verified them. Visibility differs by country, so the counts are not complete incident totals.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger, and ANSSI’s incident counts are a different measure again.
• A group’s claim is not proof of compromise. We use “claim” for an unverified listing and “incident” only for an established event. We have not independently verified any published dataset, and several brands in this report post claims with little or no evidence.
• Attributing a victim to a country is imperfect, and some firms operate across Europe. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker: a seller of ready-made entry into a network. Commune: the lowest tier of French local government.

2. Timeline: a steady flow with a March peak

The pattern is a steady flow of roughly 20 claims a month, with a peak of 34 in March and a second high of 25 in August. March is helped by four claims against large brands on 1 March from a single data-theft persona and four Qilin claims on 3 March, and August by three Krybit claims on 7 August. The first seven days of October added six more listings against five organizations, so the flow has not stopped.

ANSSI's own view is steadier. Its Panorama de la cybermenace 2025, published in March 2026, says 128 ransomware compromises were reported to the agency in 2025, slightly down from 141 in 2024, while data-exfiltration incidents rose to 196 from 130. The two series measure different things: ANSSI counts incidents reported to it, and leak sites count public claims. They show two simultaneous trends: ransomware compromises reported to ANSSI edged down while data-exfiltration incidents rose.

3. The groups at a glance

Forty-two groups made 185 claims. The top two made 76 (41%), the next seven made 45, and 33 groups made 64 between them, 22 of those with one or two claims. That is a concentrated head and a long tail. The top two account for four claims in ten, which is a share of observed claims, not of intrusions or indicators, and the rest of the field is too varied for a single list.

The same groups in France and the Gulf

Nineteen of the 42 groups also posted Gulf victims in the same period, and they made 143 of the French claims. The table shows the twelve with the most French claims.

Gulf counts come from our six Gulf country reports and the Gulf summary. Read the Gulf summary

4. Who is being hit

Our own classification of the 185 claims, using the tracker’s sector tags, with the public sector grouped. Each claim is counted once.

Professional services top the list at 21%. Nine of them are accounting and law practices, each claimed by a different group, which suggests no single campaign but a steady appetite for firms that hold other organizations' financial files. The public sector and education take 17, and 12 of those are communes and communities of communes. ANSSI's 2025 data show small and mid-sized firms at 48% of the ransomware victims it handled and local authorities at 11%. That broadly matches the mix we observe, though the sources and counting methods differ. The Gulf mix is different: more suppliers to energy and aviation, few municipalities.

In France the typical victim is not a household name. It is the firm next door to one.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. Qilin, a daily steady stream (42 claims)

Claims. From 7 January to 24 September, Qilin posted 42 French organizations. Four came on 3 March alone. The mix includes law and advisory firms, hotels and a travel agency, an industrial manufacturer listed on 1 March, a technology distributor on 27 April, a sports club on 5 August, three municipalities, and several food and agricultural cooperatives.
Reading. The spread of sectors, sizes, and dates fits a RaaS brand whose affiliates choose targets by access, not by industry. ANSSI names Qilin the most represented ransomware strain in France in 2025, at 21%, so the pattern predates this year. On 9 October the press reported that Japan had confirmed the arrest of a 28-year-old Russian national accused of being a core Qilin member. He was detained in Osaka in May and, according to reports, handed over to Germany on 2 October. The reports tie him to attacks on German companies, not to French victims. It is too soon to read an effect on French activity: Qilin claims continued after the May arrest, and its latest France-linked claim in our data is dated 24 September.
Confidence. High on the counts and dates. Low on how affiliates pick targets.

Case 2. The Gentlemen, posting in batches (34 claims)

Claims. The group started on 20 January and has made 34 claims, with batches of three on 18 June, four on 30 June, and three on 23 July. Victims include a cooperative of independent hardware distributors, a laundry and linen-rental firm, a royalty-collection body, a works council, wine estates, and an ophthalmology clinic. Two more landed in the first week of October.
Reading. Batch posting may mean the group publishes several listings at once instead of as each negotiation ends. Its profiles read as if built from commercial databases, which may be why they list firms whose own websites say little. France is its largest market in our two datasets, with 34 claims here against 16 in the Gulf, so the French list is where its pace shows most clearly.
Confidence. High on counts and dates. Low on why France is such a large share.

Case 3. Twelve local authorities, eight groups

Claims. Twelve communes and communities of communes were listed between January and September: Qilin three, The Gentlemen two, Kairos two, and DragonForce, Lynx, MedusaLocker, Payload, and Krybit one each. Dunkirk was among them on 5 January, and municipalities in the south, the north, and the Paris region followed. A school-network claim in May and a ministry claim on 1 March came on top.
Reading. Eight different groups made the twelve claims, so this is not one campaign. Communes hold civil-registry records, school-meal and payroll data, and often run their IT through small providers or shared syndicates, so one weak provider can serve many. That is a hypothesis, not a finding. ANSSI says territorial authorities were 11% of its ransomware victims in 2025, slightly down on the year before.
Confidence. High that the listings exist. Low on cause.

Case 4. The data-theft brands and the big names

Claims. A set of brands that sell or leak stolen data, without clear encryption, account for the best-known French names on the list. A persona calling itself Lapsus$ listed four large names at once on 1 March: a ministry, a university, a clothing house, and an infrastructure group. Coinbase Cartel made seven claims, including an energy group, a software vendor, and a software publisher, three of them within five days in April. Clop listed an office-space provider, one unidentified domain, and a trade union. ShinyHunters claimed an IP-services firm on 1 August, with the tracker quoting more than 21 million Salesforce records.
Reading. These claims come with automatically generated company descriptions and little proof. ANSSI notes that claimed data may come from older leaks or several sources, and that exfiltration incidents rose to 196 in 2025 from 130. For a named firm the first step is to qualify the data: where it comes from, how old it is, and whether it matches the firm's records.
Confidence. High that the listings exist. Low that any describes a new intrusion.

Case 5. The adviser layer: nine firms, nine groups

Claims. Nine accounting and law practices were listed: a regional chartered-accountants' body (Bravox), a law firm (Kairos), another law firm (Qilin), an accounting firm (Anubis), an accounting practice (DragonForce), an audit firm (LockBit 5.0), an accounting and advisory firm (ZaWoo), an accounting-advisory brand (Everest), and a large accounting-services group (Lamashtu, 30 September). Nine firms, nine different groups.
Reading. No shared campaign shows. What the list shows is that many unrelated groups reach for the same kind of target: a firm whose files cover dozens or hundreds of clients, with a small IT team. For the clients, the exposure is secondary: their ledgers, payroll, and contracts sit with someone else. French firms should ask their accountant and their lawyer what they would do on the day of an incident, and in what order they would tell clients.
Confidence. High on counts. Moderate on the supplier-risk reading, which is our inference.

Case 6. October already: six listings, five organizations

Claims. Between 1 and 7 October the tracker lists six more claims outside the window: Krybit three times (two against one telecom-services group on 1 and 4 October, and one against a commune on 2 October), The Gentlemen twice (a judicial-officer firm and an industrial contractor, both in the first week of October), and DragonForce once (7 October).
Reading. Krybit's five claims in Q3 plus three listings in four days of October, against two organizations, mark it as the fastest-growing French name after the two leaders. Its record also includes five UAE firms. Re-listing the same organization by the same group three days later may reflect a negotiation deadline passing, though that needs confirmation.
Confidence. High on the listings. Moderate on Krybit's growth, which rests on a few weeks.

6. Active threat actors: presence, motivation, and TTPs

Five selected actors, chosen for relevance to defenders and not by volume, made 98 of the 185 claims and are profiled below. Coinbase Cartel and Akira rank above Krybit by count and appear in the list that follows. Their public technical detail comes from global incident reporting, not from the French cases, so read the tradecraft as known behavior of each group in general, not proof of what happened to a named French firm. Technique IDs refer to MITRE ATT&CK.

Four actors with sufficient public technical reporting are shown. Marks reflect public reporting on each group worldwide, not French incident evidence. An empty cell means the technique is not documented in the sources we reviewed, not that the group does not use it. Krybit has no column because we hold less public technical reporting on it.

Actor profiles

Other groups worth knowing

• Coinbase Cartel (7) and Lapsus$ (4). Data-theft brands with thin evidence and generated company descriptions. See Case 4.
• Akira (6). Four in Q1, none in Q3: a rental firm, a manufacturer of components, a connector maker, an engineering firm, a diagnostics company, and a dairy-equipment maker.
• Lamashtu (5), Nova (4), MedusaLocker (4), Anubis (4), Kairos (4), ZaWoo (4). Mid-sized brands with a handful of claims each, mixing small manufacturers, schools, communes, accounting firms, and, for Kairos, a hospital-expertise centre on 30 September. Anubis posts claims worded as a data breach at a named firm, and several are accounting or engineering firms.
• Lynx (3), Clop (3), ALP-001 (3), Bravox (3), Panzer (3). Three each. Lynx listed three firms on one day, 5 January, including a city and two private companies.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. One tracker counts 1,369 French-targeted forum posts across its whole history, not only this report’s window. We captured 19 listings from 4 to 10 October, which is enough to show the shape of the market but not to measure it. We name no victims here, because the claims are unverified and naming a target may amplify an unproven claim.

What the market looks like

• Concentrated handles. The tracker's top five handles account for 251 posts (18%): ChimeraZ 122, HexDex 52, misere 34, DumpSec 22, and X-VDP-X 21. ChimeraZ alone makes 9% and also appears in our Kuwait sample, with an airline offer on 11 September, and in Swiss-tagged listings.
• Concentrated venues. The largest single source, one forum, carries 459 posts (34%), and the next four sources carry 174, 117, 116, and 95.
• Record-count titles. Most captured listings state a record count in the title, from about 7,000 to about 1.4 million. They cover public-sector portals, a justice-ministry service, a payment agency, a commercial-court registry, a water body, a holiday-benefit fund, a retailer loyalty program, a national scout association, a school, and an insurance broker.
• Bumping. One handle posted the same water-utility listing on 8 and 9 October, which is a repost, not a second breach.

ANSSI cautions that data published by attackers may come from older leaks or several sources, and that victims should qualify it before acting. We apply the same rule. For a public-sector body or a retailer, that means checking whether a sample matches current records, how old the fields look, and whether the poster is reselling something already public.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. We cannot link any listing to any claim, and we do not.

8. Update outside the report window: October 2026

Between 1 and 7 October the tracker lists six more France-linked leak-site claims against five organizations (Case 6), and our forum capture shows listings every day from 4 to 10 October. On 9 October the press reported the Qilin arrest described in Case 1. None of these is in the 185.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public ANSSI and vendor reporting. The consistent picture:

• Exposed remote access and valid accounts. Vendors describe Qilin and LockBit 5.0 affiliates working through VPN accounts, remote services, and management tools that blend into normal administration.
• Data theft without encryption. ANSSI says vendors report a growing share of extortion without ransomware deployment, though it remains limited in its own caseload, and that data-exfiltration incidents known to it, with or without ransomware, rose from 130 to 196 in 2025.
• Bought access and stolen credentials. Forum sellers offer records and access cheaply, and combolists feed credential stuffing, account takeover, and business email compromise.
• Shared providers. Accounting firms, small IT providers, and syndicates that serve many communes hold many organizations' files, which is one hypothesis worth investigating among several.

10. The regulatory frame

France applies the EU General Data Protection Regulation. The data-protection authority, the CNIL, says a personal data breach that creates a risk to individuals must be notified to it as soon as possible after discovery, within 72 hours where possible, with an explanation if the deadline is missed, and individuals must also be informed when the risk is high. Notifications go through the CNIL’s online service. ANSSI’s panorama adds that a victim whose data is confirmed taken must also meet its regulatory duties, including the CNIL declaration. On cybersecurity rules, France is still transposing the EU’s NIS 2 directive through the Résilience bill (bill no. 1779). Commentators say the Senate has passed it, and the National Assembly’s website shows amendments being processed in early October, so we treat it as not yet in force. We have not verified its exact stage in the official dossier, and we could not substantiate a reported referral to the EU Court of Justice, so we do not rely on one. The directive’s reporting sequence, an early alert within 24 hours, a notification within 72 hours, and a final report within a month, applies only to entities in scope once national law takes effect. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the data above.

1. The flow continues at 50 to 80 claims a quarter. The first week of October added six listings, and the quarterly record has stayed between 57 and 66. This is a qualitative scenario, not a statistical forecast. It assumes broadly stable collection coverage and attribution rules, and a change in either, or the loss of a major leak site, would move it.
2. Qilin and The Gentlemen stay on top. Together they hold 41% of the record. The Qilin arrest in Germany is unlikely to change that on its own, since affiliates, not the arrested person, choose targets.
3. Krybit keeps growing. It went from none in Q1 to five claims in Q3 and three listings in early October, on a short record, and it works the Gulf too.
4. Local authorities and advisers remain targets. Communes and accounting and law practices drew claims from many groups, so expect more from new brands as well.
5. Data-theft listings against big names continue. They are cheap to post and carry little proof, so each one needs qualifying before a reaction.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse.
3. Ask your accountant, lawyer, and IT provider what they hold and how they protect it. Request MFA, EDR, and offline-backup evidence, and agree in advance how and when they will tell you about an incident.
4. Local authorities: separate the shared providers. List which syndicate or provider hosts your civil-registry, payroll, and school systems, check its backups, and test restoring them without the production network.
5. Qualify claimed data before you react. If your name appears with a record count, check where the data could come from, how old it is, and whether it matches your records, then decide on notification with your data-protection officer.
6. Rehearse the double-extortion call. Know who notifies the CNIL and ANSSI, who briefs the board, and who decides on negotiation. Write it down and test it.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• ANSSI / CERT-FR, Panorama de la cybermenace 2025 (March 2026)
• CNIL, Notifier une violation de données personnelles
• The Record, Japan confirms arrest of Russian Qilin operative, extradition to Germany
• SecurityWeek, Qilin ransomware suspect arrested in Japan, extradited to Germany
• Check Point Research, The State of Ransomware Q1 2026
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• Proven Data, Qilin attack chain and MITRE ATT&CK TTPs
• Proven Data, LockBit 5.0 technical analysis and TTPs
• NIS Solutions, NIS2 in France (secondary source, status of the Résilience bill)

Sources are linked in their original language.