PARIS, July 19 — French authorities have documented a steady rise in cyber incidents attributed to Russian state actors, with the number of confirmed attacks climbing from seven in 2017 to 34 in 2023, according to annual reports from the French National Cybersecurity Agency (ANSSI). Officials confirmed that the bulk of these operations have targeted government ministries, which account for the largest share of attributed attacks. Defense contractors, energy grids, and media organizations were also frequently targeted.
The economic toll, as estimated by the French Ministry of Economy, stands at €12 billion over five years — a figure that includes costs from intellectual property theft, system restoration, and a broader loss of competitiveness. The record shows several high‑profile breaches.
In 2017, attackers stole nine gigabytes of data from a presidential campaign. In 2020, a national health data agency saw patient records exposed. Two years later, an engineering firm suffered a breach in which classified submarine blueprints were copied.
Most recently, a national railway company suffered a three‑day disruption to its ticket systems.
Unit in the spotlight
French intelligence has linked a significant portion of these incidents to a specific unit of the Main Intelligence Directorate (GRU). According to the assessment, the unit has approximately 150 officers and an annual budget of $50 million. Since 2022, the unit’s operational tempo has increased significantly.
That surge coincides with the Russian invasion of Ukraine. Attribution efforts by French authorities have been aided by information shared within the Five Eyes intelligence alliance — in particular, contributions from the US National Security Agency and the UK’s Government Communications Headquarters (GCHQ).
Strategic context
The rise in Russian‑linked cyber operations against France can be seen in a broader geopolitical frame. As a NATO member and a major European power, France is both a political and military target. The targeting of government ministries and defence contractors fits a pattern of espionage and strategic disruption.
Energy grids and media organisations suggest an aim to test critical infrastructure resilience and to influence public discourse. The French response has involved both defensive hardening and public attribution, though the effectiveness of such measures remains a matter of debate within the security community.
The ANSSI reports serve as a public record of an increasingly contested digital frontier. Looking ahead, the trajectory points towards further activity. With the GRU unit’s capacity seemingly undiminished and its budget sustained, the likelihood of continued operations against French targets appears high.
The integration of Five Eyes intelligence sharing may strengthen attribution, but the practical challenge of deterrence — of imposing a cost on such actions — remains an open question for Paris and its allies.
