France

This page covers cyber threats to France. It brings together official French texts (the national cyber agency ANSSI and its CERT-FR, the Ministry for Europe and Foreign Affairs, the data protection regulator CNIL), MITRE ATT&CK, the BBC and Brandefense research. Where an official source names France as a target, the page says who said it and when.

Threat groups that official sources link to France

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT28: on 29 April 2025 the French Ministry for Europe and Foreign Affairs said that Russia’s military intelligence service (GRU) used the APT28 attack group, and that since 2021 it had been used to target or compromise a dozen French entities. The ministry said these include public services, private companies and a sport organization involved in the 2024 Olympic and Paralympic Games. It added that the same group was used in the 2015 sabotage of TV5Monde and in attempts to destabilize the 2017 French elections. On the same day CERT-FR published a report saying that in 2024 the campaigns hit governmental, diplomatic and research entities.

Sandworm: on 15 February 2021 CERT-FR reported an intrusion campaign against Centreon monitoring software that breached several French entities, mostly IT and web hosting providers, from late 2017 to 2020. ANSSI said the campaign bears several similarities with earlier campaigns attributed to Sandworm. It did not name the group as the author. Separately, MITRE ATT&CK lists the targeting of the 2017 French presidential campaign among the operations in the October 2020 US indictment of six GRU officers associated with Sandworm.

Incidents on record

The incidents listed below are the major ones that French authorities, the organizations themselves or major news outlets reported, with national impact. Small incidents are not listed.

What ANSSI reports

ANSSI’s Cyber Threat Overview 2025, published on 11 March 2026, says ANSSI handled 3,586 security events in 2025, 18 percent fewer than in 2024. It links the fall to the report peaks seen during the Paris Games between May and August 2024. The most targeted sectors were education and research (34 percent), ministries and local authorities (24 percent), health (10 percent) and telecommunications (9 percent).

ANSSI says the attackers that targeted French interests are linked to Russia and China, mainly for espionage or pre-positioning. It says attacks on critical infrastructure, in particular telecommunications and energy, through sabotage attempts remain popular with these actors. It reports a rise in cybercrime incidents, with more data theft, and notes that only 42 percent of the 460 events classed as possible data leaks were confirmed. It says edge devices remain a favored target because of the many vulnerabilities in them. The director general wrote that the coordinated destructive attacks on Polish electricity infrastructure at the end of 2025 are the feared scenario France is preparing for.

For the Paris 2024 Games, ANSSI counted 548 cyber security events affecting entities linked to the organization between 8 May and 8 September 2024 and said none affected the opening or closing ceremonies or the competitions.

How attackers target France: Brandefense research

The posts below mention France. We summarize only what they say.

State-linked activity. Our post on the Serpent backdoor (March 2022) describes attacks on French construction, real estate and government organizations that began with phishing emails carrying Word macros. It says the campaign was not tied to a known actor. Our APT28 profile post lists attempts to penetrate French election campaigns in 2017. Our Winter Vivern post lists France among the geographic focus of that espionage group, and our El Machete post lists France among the countries that group has targeted.

Banking and fraud. Our post on the OCTO Android banking trojan says it targets financial institutions in several countries, including France. Our weekly news archive for Q4 2022 says financial service providers in France and other countries were among the hardest hit by the Godfather trojan.

Paris 2024. Our Paris 2024 threat post reports dark web findings on fake tickets and merchandise and phishing pages selling Olympic tokens. Our post on Olympic scams describes fake tickets, shops and mobile data offers, and says French gendarmerie cyber patrols identified 338 fraudulent ticket sites.

Data leaks. Our post on the WhatsApp claim lists 20 million French users among the claimed data, which a threat actor said it held. Our SurveyLama post covers a February 2024 breach of 4.4 million users at an online survey platform run by a French company.

Ransomware. Our Q2 2026 ransomware ranking lists France, with the United States, Canada, the United Kingdom and Germany, in the geographic focus of Qilin, the top group of that quarter. Our Anonymous Sudan post lists France among the countries reached by that group’s DDoS attacks.

Rules. Our NIS2 and DORA post says supervisors in France, Germany and the Netherlands signaled that register deficiencies are an enforcement priority.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand, such as the fake ticket sites seen around the Paris Games.

Law and national strategy

ANSSI is the national authority for cyber security and cyber defense in France. Its page says its purpose is to build and organize, across ministries, the protection of the Nation against cyber attacks, and lists five missions: defend, know, share, support and regulate.

The National Cyber Security Strategy 2026-2030 was commissioned by the President of the Republic. ANSSI’s strategy page says it extends the National Strategic Review, sets France’s course to become a leading cyber nation, and was drawn up under the General Secretariat for Defense and National Security (SGDSN) with all ministries and a panel of experts.

On the EU NIS 2 Directive, ANSSI’s page says the extension of scope is without precedent in cyber rules. It describes a draft Resilience law (projet de loi Résilience) and says ANSSI made the Cyber Reference Framework for France (ReCyF) available from 17 March 2026 as a working document. The framework is not mandatory by default, and entities that apply it can rely on it in an ANSSI inspection. Check the current status of the law before relying on this page.

How incident response is organized

CERT-FR describes itself as the French national and governmental CERT and publishes security alerts and threat reports. ANSSI works with partners in the Cyber Crisis Coordination Centre (C4) on intrusions such as the APT28 campaigns. For the Paris Games, ANSSI acted as the single entry point for cyber reports. NIS 2 gives a formal framework to the CyCLONe network that links ANSSI and its European counterparts.

Personal data

The CNIL is the French personal data regulator. On 22 January 2026 it fined France Travail, the public employment operator, 5 million euros for failing to secure job seekers’ data, after an attack that France Travail said in March 2024 may have exposed data of 43 million people. The CNIL says security measures suited to the risk are an obligation of means under Article 32 of the GDPR.

Counts of attacks by sector will come from Brandefense Atlas. The figures above are ANSSI’s own, for the events it handled.