Written by Jean-Georges NANOT, May 13, 2026
Table of contents
- Understanding ransomware in 2026
- What French cyber policies cover for ransomware
- Subscription requirements and exclusions in 2026
- The first 48 hours: ransomware response protocol
- Conclusion: pay or don’t pay, insurance is the last line
- Real-world case: ransomware at a French subsidiary, decision not to pay
- Frequently asked questions
Introduction
According to ANSSI’s 2025 cybermenace panorama, ransomware remains the first cyber threat in France in both volume and impact. More than 1,200 significant incidents were handled by French national authorities, of which 60% targeted mid-cap and SME entities. The average ransom demand has risen 38% between 2023 and 2025, and the total cost of a ransomware incident in France averaged EUR 4.17M per IBM Cost of a Data Breach 2024.
For foreign-headquartered groups operating French subsidiaries, ransomware response requires French-specific dispositions: French-language forensic team, French-language negotiator if payment considered, CNIL notification compliance, French Code des assurances notification deadlines, and coordination with the global cyber program. CBE Consulting advises foreign groups on French-specific ransomware response setups.
1. Understanding ransomware in 2026
Threat evolution
Three major transformations of ransomware since 2017-2019:
Attacker professionalization: criminal groups operate in ransomware-as-a-service mode. Malware developers rent tools to affiliates. This specialization makes attacks more sophisticated, better targeted, harder to detect.
Systematic double extortion: since 2020, attackers exfiltrate data before encrypting it. If the company refuses to pay, data is published on public sites or sold. This dual pressure (encryption + disclosure) increases psychological and financial pressure on directors.
Supply chain and IT provider targeting: attackers compromise an IT provider (cloud host, MSP, IT outsourcer) then propagate to clients. Cases: Kaseya (2021), MOVEit (2023). A French subsidiary can be hit by ransomware without being the initial target.
Attacker ecosystem
Three families structure the 2026 landscape:
- Organized criminal groups: LockBit (until partial dismantling in 2024), Black Basta, Cl0p, Akira, Play. Pure financial logic. Target mid-caps and large accounts based on estimated payment capacity
- Independent affiliates: pirates using RaaS tools rented from main groups. Varied profiles, less predictable
- State actors: groups linked to states (Russia, North Korea, Iran, certain Chinese factions) using ransomware as financing or destabilization tool. Rarer but more complex (sanctions clause)
Average cost and impact in France
Per IBM Cost of a Data Breach 2024 and ANSSI:
- Average total cost of ransomware loss for a French mid-cap subsidiary: EUR 4.17M
- Average operational shutdown: 18-28 days
- Cost breakdown: business interruption 45-55%, forensic and reconstruction 25-35%, GDPR legal fees 8-12%, crisis communication 5-8%, ransom (if paid) 5-15%
- French companies paying ransom: in decline from 50% in 2020 to ~25% in 2025
Total economic cost exceeds 5-8 times the ransom amount. Not paying doesn’t eliminate the loss, it’s just one decision among many.
2. What French cyber policies cover for ransomware
Five activatable coverages
A modern French cyber policy activated for ransomware covers five components:
1. Forensic and investigation costs: handled by a specialized team (Mandiant, Kivu, Arete, Crowdstrike, NTT Security) commissioned by the insurer. Investigation of entry vectors, compromise perimeter, exfiltrated data. Typical cost: EUR 50-250K for a French mid-cap.
2. IT system and data reconstruction: replacement of compromised hardware, system reinstallation, backup restoration, post-incident security audit. Typical cost: EUR 100-400K for a French mid-cap.
3. Business interruption: indemnification of revenue loss during operational shutdown, on the negotiated indemnification period (typically 6-12 months). Often the most important loss item.
4. Cyber extortion: covers under strict conditions ransom payment, agreed negotiator fees, ancillary costs (cryptocurrencies, Bitcoin purchase on regulated platforms).
5. GDPR legal fees and notifications: specialized French digital law attorneys, CNIL notifications and affected persons (a recent case affected 4,200 persons), defense against civil actions, French expert judicial fees.
Ransom payment mechanism
Ransom payment by the cyber insurer follows a strict 2026 protocol:
- Step 1: immediate declaration to insurer via 24/7 hotline
- Step 2: mobilization of agreed negotiator (Coveware, Kivu, Mandiant Negotiations, Arete Negotiation Services)
- Step 3: encryption technical quality analysis (will post-payment decryption be reliable?)
- Step 4: OFAC sanctions clause verification: is the ransom beneficiary on a sanctions list?
- Step 5: insurer and negotiator recommendation (pay or not)
- Step 6: final company decision (insurer never obligates payment)
- Step 7: if payment, execution via regulated channels (cryptocurrencies from agreed exchanges, fiscal traceability)
This protocol typically takes 5-15 days depending on complexity, during which the company operates in degraded mode.
OFAC sanctions: the limiting clause
OFAC (Office of Foreign Assets Control, US Treasury agency) publishes a list of sanctioned persons and entities (SDN List) where any payment is illegal for actors under US jurisdiction. Several ransomware groups have been added to this list since 2020: Evil Corp (2019), TrickBot, Conti (partially), certain LockBit factions.
If the identified attacker is on the SDN List, ransom payment is illegal and not covered. The policy’s sanctions clause automatically activates this exclusion. The company must then manage without ransom payment: reconstruction from backups or partial data abandonment.
This dimension partly explains the payment rate decrease since 2020. Regulatory pressure and the sanctions clause strongly incentivize rebuilding rather than paying.
3. Subscription requirements and exclusions in 2026
War exclusion (extended)
Since Merck v. ACE (2022) and Mondelez v. Zurich (2023) case law, French and European courts confirmed that cyber attacks attributed to a state can be excluded under the war exclusion of cyber policies. Insurers have hardened wording: exclusion of any cyber act attributable to a state or para-state actor.
To negotiate finely: too-broad wording (excluding any attack “originating” from a given country) creates major risk because state attribution is often contested. Preferred wording requires official attribution by US or European authorities (CISA, ANSSI), not mere presumption.
Gross negligence and patch defaults
Cyber insurers now explicitly exclude losses caused by gross negligence: non-application of critical patches known for several months, total absence of MFA on privileged access, manifestly insufficient practices. This exclusion doesn’t apply to reasonable failures but to characterized failures.
To limit this exclusion’s application: documented patch management program (policy, frequency, documented exceptions) and demonstration that practices conform to references (NIST CSF, ANSSI PSSI guide).
Minimum technical requirements
In 2026, French cyber insurers no longer grant coverage without a minimum cybersecurity floor:
- Generalized MFA on remote and privileged access
- EDR or next-generation antivirus
- Immutable backups (offline or isolated cloud)
- Documented incident response plan, tested annually
- Annual phishing training with exercises
- Privileged account management (PAM, password vault)
- Documented patch management
The subscription questionnaire counts 60-120 questions. For mid-cap French subsidiaries, a preliminary audit by a commissioned preventionist has become standard.
Free assessment of your ransomware coverage
Does your French subsidiary have a cyber policy subscribed more than 18 months ago, or no cyber coverage currently? CBE Consulting offers a free assessment of your ransomware exposure and coverage. 30 minutes by video, no commitment.
Request an assessment → · +33 9 80 43 16 34 · secretariat@cbeconsulting.fr
4. The first 48 hours: ransomware response protocol
Detection and declaration
The first hours following ransomware detection largely condition the loss outcome. Six actions in parallel in the first 6 hours:
- Activate the internal crisis cell (CEO, IT/CISO, legal, communications, HR)
- Isolate compromised systems to prevent propagation (network disconnection, don’t shut down)
- Preserve evidence (logs, RAM memory, compromise indicators)
- Contact the insurer’s cyber hotline (number on policy cover page)
- Do not attempt autonomous negotiation with attackers
- Prepare initial communication (internal and external per affected perimeter)
Declaration speed to insurer often conditions resolution success. Late declaration over 48 hours can trigger coverage restrictions.
Forensic and evidence preservation
The forensic team commissioned by the insurer intervenes within 24-48 hours, generally remotely first, on-site after if necessary. Three objectives:
- Identify entry vector: phishing, exploit, provider compromise, remote access
- Measure compromise perimeter: machines affected, accounts used, data accessed
- Evaluate exfiltration: what data exited, to what destination, qualify applicable GDPR
The forensic produces a technical report serving as basis for all subsequent decisions: pay or not, reconstruction, notifications, legal defense.
Decision on ransom and reconstruction
Beyond forensic, the major decision is to pay or not. Typical decision criteria:
- Backup quality: if immutable backups intact and exploitable, reconstruction preferable
- Exfiltration perimeter: if sensitive data exfiltrated, payment doesn’t suppress disclosure risk (broken promises on attacker side)
- OFAC sanctions verification: if prohibited, no choice
- French government position: since 2024, official position is not to pay
- Cost-benefit calculation: ransom vs. reconstruction cost from backups
In 2025, about 75% of French companies hit now choose not to pay. Reconstruction from immutable backups has demonstrated effectiveness when the disposition is properly prepared in advance.
5. Conclusion: pay or don’t pay, insurance is the last line
Ransomware remains in 2026 the first cyber threat for French subsidiaries of foreign-headquartered groups. Properly dimensioned cyber insurance covers 70-95% of a ransomware loss, provided technical subscription requirements are respected in advance, declaration is fast in case of loss, and the pay-or-not decision is made in full information.
For French operations, the dedicated French cyber policy or the proper coordination of the global cyber policy with French requirements is essential. To engage a personalized audit, contact CBE Consulting via the contact page.
6. Real-world case: ransomware at a French subsidiary, decision not to pay
Context: French subsidiary of a US distribution group (subsidiary revenue EUR 140M, 320 employees, 4 logistics warehouses, central ERP). Cyber policy subscribed 2 months before attack: limit EUR 2M, deductible EUR 50K, cyber extortion coverage included.
Detection and declaration (May 2024): * Monday 6:00 AM: IT discovers ERP encrypted, ransom message displayed * Monday 9:00 AM: declaration to cyber insurer via 24/7 hotline * Monday 12:00 PM: Mandiant forensic team on site
Forensic investigation (days 1-5): * Identified vector: targeted phishing on accountant 6 days earlier * Privilege escalation in 4 days, ransomware deployment on day 5 * Exfiltration of 220 GB of data (customers, financial, HR) * Identified group: Black Basta (not OFAC-sanctioned, payment legally possible)
Ransom demand: EUR 1.8M in Bitcoin, decryption promised within 24h after payment.
Decision Friday (day 5): * Immutable backups intact (verified by forensic): reconstruction possible * Exfiltrated data: disclosure risk maintained even if payment * French government position: do not pay recommendation * Decision: do not pay, reconstruct from backups
Reconstruction (days 5-17): * Days 6-10: critical server reconstruction * Days 11-14: progressive ERP restoration in degraded mode * Days 15-17: complete operations resumption
Final costs: * Forensic: EUR 85K * IT reconstruction: EUR 240K * Crisis communication: EUR 45K * Business interruption over 17 days of partial shutdown: EUR 1.2M * GDPR legal fees and CNIL notifications (4,200 persons): EUR 35K * Total loss: EUR 1.605M
Insurance indemnification: * Policy limit EUR 2M ✓ * Deductible EUR 50K * Sub-limits respected * Final indemnification: EUR 1.48M (92% of loss covered) * At charge: EUR 125K
Lesson: declaration speed (3 hours after detection) and immutable backup quality (set up 6 months earlier on cyber audit recommendation) enabled avoiding ransom payment. Without cyber policy, this loss would have hit EBITDA by EUR 1.6M, about 11% of 2023 EBITDA.
Case profile from ANSSI Panorama de la cybermenace 2024, Mandiant M-Trends 2024, IBM Cost of a Data Breach 2024 reports.
Have CBE Consulting assess your French subsidiary’s ransomware exposure
Our consultants offer:
- A free assessment of your cybersecurity disposition and ransomware coverage
- A review of technical requirements to optimize your conditions
- A costed recommendation for coverage evolution
No commitment, by video, 30 minutes.
Phone: +33 9 80 43 16 34 Email: secretariat@cbeconsulting.fr
7. Frequently asked questions
Should we pay a ransom in case of ransomware? The final decision belongs to the company. In 2026, payment rate is declining (~25% vs. 50% in 2020). Several factors incentivize not paying: French government official position, growing immutable backup quality, disclosure risk maintained even after payment, OFAC sanctions on certain groups. Ransom represents only 5-15% of total ransomware loss cost. Good preparation (immutable backups, response plan, cyber insurance) generally enables rebuilding without paying.
Does cyber insurance really pay the ransom? Yes, under strict conditions. The contract must include cyber extortion coverage (sometimes optional). Payment must be validated by insurer and its agreed negotiator. OFAC sanctions clause applies: if attacker on SDN List, payment is illegal and not covered. In practice, the insurer often recommends not paying and covers reconstruction costs. When payment occurs, it goes through regulated channels (cryptocurrencies from agreed exchanges).
How much does a ransomware incident cost on average? Per IBM Cost of a Data Breach 2024 and ANSSI, the average total cost for a French mid-cap is EUR 4.17M. Breakdown: business interruption 45-55%, forensic and reconstruction 25-35%, GDPR legal fees 8-12%, crisis communication 5-8%, ransom (if paid) 5-15%. Real cost depends strongly on preparation quality and response speed. A well-prepared company can limit cost to EUR 1-2M.
How much does cyber insurance covering ransomware cost? Orders of magnitude 2026 for a mid-cap French operation: EUR 25,000-80,000 annual premium for EUR 5-10M limit covering complete ransomware loss. Premium varies by risk profile, cybersecurity disposition quality, claims history, sector. A French subsidiary mature in cybersecurity (generalized MFA, EDR, immutable backups, annual training) obtains 25-40% better conditions.
What technical pre-requisites do insurers require? Minimum 2026 floor: generalized MFA on remote and privileged access, EDR or next-generation antivirus, immutable backups (offline or isolated cloud), documented incident response plan tested annually, annual phishing training with exercises, privileged account management (PAM), documented patch management. Without this floor, insurers refuse or require dissuasive deductibles and exclusions. A preliminary cyber audit has become standard for mid-caps.
What to do in the first hours after ransomware detection? Six actions in parallel in the first 6 hours: 1) activate internal crisis cell, 2) isolate compromised systems without shutting them down, 3) preserve evidence (logs, memory), 4) contact insurer’s cyber hotline, 5) do not attempt autonomous negotiation, 6) prepare initial communication. Declaration speed largely conditions the loss outcome. Late declaration over 48 hours can trigger coverage restrictions.
About the author: Jean-Georges NANOT
Jean-Georges NANOT is consulting broker and founder of CBE Consulting, an insurance broking firm based in France specialized in international risk management. He advises French ETIs with international activity and foreign-headquartered subsidiaries in France on insurance program structuring, risk audits, and claims management.
ORIAS no. 15000172 LinkedIn: [to be completed] View all articles by this author
About this article
This article was written by Jean-Georges NANOT to provide expert insight on the topic discussed. The information presented is of a general nature and does not replace a personalized audit. Each situation requires specific analysis of your risk exposure. For an assessment adapted to your company, contact our team.
CBE Consulting, Cap de Bonne-Espérance Consulting, insurance broker. ORIAS no. 15000172 Supervisory authority: ACPR, 4 place de Budapest, 75009 Paris, France.
Sources and references
- ANSSI, Panorama de la cybermenace 2024 and 2025
- Cybermalveillance.gouv.fr
- IBM Cost of a Data Breach Report 2024
- Mandiant M-Trends 2024
- ENISA Threat Landscape 2024
- OFAC SDN List
- CNIL, GDPR recommendations
- Coveware, Ransomware Quarterly Report
- ACPR
Featured Industries
Become an Expert!
Get the latest insights from our newsletter.
Free 31 page Blueprint For Consultants
Complex situation, changing demands and dynamic market environment make today's business even more challenging.