Written by Jean-Georges NANOT, May 13, 2026
Table of contents
- Reference sources and 2026 methodology
- Cost breakdown of a French cyber incident
- Cost matrix by size and sector
- ROI of prevention and insurance
- Conclusion: know the numbers to dimension coverage
- Real-world cases: three French incidents by company size
- Frequently asked questions
Introduction
According to IBM Cost of a Data Breach 2024, the average cost of a data breach in France reached EUR 4.17M, up 12% versus 2023. ANSSI’s 2025 Panorama de la cybermenace report confirms that French subsidiaries of foreign-headquartered groups are now among prime cybercriminal targets, judged sufficiently wealthy to pay and insufficiently protected to resist.
For foreign HQ finance directors, having reliable French-specific figures on cyber loss costs is governance basics. It’s the foundation for dimensioning insurance coverage, arbitrating prevention vs. transfer, and justifying cybersecurity budgets at French subsidiary level. CBE Consulting compiles and analyzes published benchmarks to produce figures adapted to French operations of foreign-headquartered groups. This article presents 2026 observed costs, breakdown, variation by size and sector, and typical ROI of preventive and insurance dispositions.
1. Reference sources and 2026 methodology
Key 2026 benchmark sources
Five sources structure French cyber cost benchmarking:
ANSSI Panorama de la cybermenace: published annually by France’s national cybersecurity agency. Data on incidents handled in France, breakdown by sector and size.
IBM Cost of a Data Breach Report: international annual study covering 600 victim organizations. France data isolated since 2020. Global reference for average cost and breakdown.
Cybermalveillance.gouv.fr: statistics on losses declared by French SMEs via the platform.
Hiscox Cyber Readiness Report: annual study targeted at European SMEs and mid-caps. Particularly valuable for the under-EUR 250M revenue segment.
ENISA Threat Landscape Report: European report on threats and incidents observed at EU scale.
2020-2026 evolution
Five trends structure the current decade:
- Continued rise in average cost: +35% between 2020 and 2024 per IBM
- Concentration on mid-caps: mid-cap share of victims rose from 18% to 32% between 2020 and 2025 per ANSSI
- Growth slowdown since 2024: plateau effect linked to preventive disposition improvement
- Business interruption concentration: now the dominant cost item (40-55% of total)
- Ransom payment rate decline: from 50% in 2020 to ~25% in 2025
Distribution by French entity size
Per consolidated 2024-2025 data, orders of magnitude for French operations:
| Entity size | Average cost | Typical range |
|---|---|---|
| Small (revenue < EUR 5M) | EUR 60K | EUR 20-180K |
| SME (revenue 5-50M) | EUR 230K | EUR 80-600K |
| Mid-cap (revenue 50-500M) | EUR 1.8M | EUR 600K-5M |
| Large operations (revenue > 500M) | EUR 7M | EUR 3-25M |
These figures include direct costs and business interruption. They exclude potential ransom (rare in 2026) and long-term reputation damages.
2. Cost breakdown of a French cyber incident
Forensic and reconstruction
First direct expense item: technical investigation and operational restoration costs.
Forensic: specialized team intervention (Mandiant, Kivu, Arete, Crowdstrike, Wavestone, NTT Security) to identify entry vector, measure compromise perimeter, qualify exfiltration. Typical cost for French entities:
- SME: EUR 30-80K
- Mid-cap: EUR 80-250K
- Large operations: EUR 200-800K
IT system and data reconstruction: typical cost:
- SME: EUR 50-200K
- Mid-cap: EUR 150-600K
- Large operations: EUR 500K-3M
Business interruption and working capital
Most important item of modern cyber incidents: business interruption during operational shutdown.
For a French mid-cap subsidiary, operational shutdown is measured in days:
- Average complete shutdown duration: 4-8 days
- Average degraded mode duration: 7-21 days
- Complete recovery: 14-45 days after incident
During this period, effective revenue drops 30-95%. For a French subsidiary at EUR 100M revenue, gross margin loss over 20 days of partial shutdown typically ranges between EUR 800K and EUR 2.5M.
Working capital is also impacted: invoicing delays, collection delays, supplier payment delays, inventory immobilization. Cumulative cash flow impact can represent 30-60 days of revenue temporarily.
GDPR legal fees and compliance
Third item: GDPR legal and compliance costs, with specific French dimensions.
- Specialized French digital law attorneys: EUR 20-100K for a French mid-cap over 6-12 months
- GDPR notifications: depending on affected persons. For 5,000 persons: EUR 8-25K in material costs
- CNIL defense: EUR 15-80K depending on complexity
- CNIL sanctions: risk up to 4% of global revenue in serious cases, in practice 0.1-1% of revenue for French mid-caps
- Third-party civil actions: collective or individual, case-by-case quantified
Cumulative French legal exposure of a French mid-cap on a typical cyber incident: EUR 80-400K, excluding potential CNIL sanctions or convictions.
Crisis communication and reputation
Fourth item: crisis communication and reputation damage.
- French PR agency fees (Image 7, Brunswick, Havas Paris): EUR 30-120K
- Internal and customer communication: EUR 15-60K
- Quantified reputation damage: variable, EUR 0 to several million depending on virality
For a French subsidiary without mature crisis management disposition, reputation damage can represent up to 30% of total incident cost.
3. Cost matrix by size and sector
Sectoral cost variation
Business sector strongly influences cyber incident cost. Observed multipliers (vs. all-sectors average):
| Sector | Multiplier | Why |
|---|---|---|
| Financial services | x 1.8 | Ultra-sensitive data, ACPR oversight, high sanctions |
| Healthcare | x 1.6 | Health data, HDS requirements, patient image |
| E-commerce and retail | x 1.4 | Critical SI dependency, customer data volumes |
| Industry | x 1.1 | Costly production shutdown but limited legal costs |
| B2B services | x 0.9 | Less sensitive data, simpler compliance |
| Small operations and professionals | x 0.5 | Reduced perimeter but high revenue/loss ratio |
For personalized calculation, these multipliers apply to the average cost by size indicated in section 1.
Complete expected cost matrix
Crossing size and sector, here’s the expected cost matrix for a major cyber loss in France 2026:
| Sector / Size | SME | Mid-cap | Large operations |
|---|---|---|---|
| Industry | EUR 250K | EUR 2M | EUR 7.5M |
| E-commerce / Retail | EUR 320K | EUR 2.5M | EUR 10M |
| B2B services | EUR 200K | EUR 1.6M | EUR 6M |
| Financial services | EUR 410K | EUR 3.2M | EUR 13M |
| Healthcare | EUR 370K | EUR 2.9M | EUR 11M |
These orders of magnitude serve as reference for:
- Dimensioning cyber insurance limits
- Justifying preventive cybersecurity investments
- Building business case for HQ executive committee
Free assessment of your French cyber financial exposure
Want to quantify your French subsidiary’s cyber exposure based on your sectoral profile and size? CBE Consulting offers a free personalized assessment. 30 minutes by video, no commitment.
Request an assessment → · +33 9 80 43 16 34 · secretariat@cbeconsulting.fr
4. ROI of prevention and insurance
Preventive cybersecurity cost
For a typical French mid-cap subsidiary, recurring annual investment in preventive cybersecurity ranges typically between 0.5% and 2% of revenue. Breakdown:
- MFA and identity management: EUR 5-25K/year
- EDR or next-gen antivirus: EUR 15-60K/year
- Outsourced SOC: EUR 50-200K/year
- Immutable backups: EUR 10-40K/year
- Phishing training: EUR 5-25K/year
- Annual audits: EUR 15-50K/year
- Patch management and tools: EUR 10-40K/year
Typical total mid-cap cost: EUR 110-440K/year.
Cyber insurance cost and benefit
Cyber insurance for a French mid-cap costs typically EUR 25-80K/year for EUR 5-10M limit. Measurable benefits:
- Direct indemnification in case of loss (80-95% of typical total cost)
- Access to network of agreed forensic and negotiation providers
- 24/7 hotline and structured crisis management
- Preventive effect (subscription requires technical floor)
Prevention plus transfer articulation
The right arbitrage between prevention and transfer (insurance) rests on three principles:
Prevention first: technical cybersecurity reduces probability AND magnitude of losses. Preventive ROI is positive at first loss avoided.
Insurance as safety net: for losses passing through prevention, insurance limits financial impact. Marginal annual cost vs. major loss cost.
No prevention without insurance, no insurance without prevention: both complementary. Cyber insurers now require minimum technical floor for subscription; preventive dispositions without insurance leave the company exposed to residual losses.
Typical 5-year ROI of global disposition (prevention plus insurance): the first major loss avoided or well-managed pays 5-10 years of disposition.
5. Conclusion: know the numbers to dimension coverage
2026 cyber cost benchmarks are not abstract statistics. They are operational tools to dimension budgets, dimension insurance limits, justify preventive investments, compare your profile to your sector. For a French subsidiary mature in financial governance, these figures feed a quarterly cyber dashboard presented to executive committee. To engage a personalized assessment of your French cyber financial exposure, contact CBE Consulting via the contact page.
6. Real-world cases: three French incidents by company size
Case 1: French SME industrial subsidiary, EUR 18M revenue, ransomware: * Forensic and reconstruction: EUR 95K * Business interruption over 12 days of partial shutdown: EUR 145K * Communication and legal: EUR 32K * Total: EUR 272K * Cyber policy in place (EUR 1M limit, EUR 10K deductible): indemnification EUR 235K
Case 2: French mid-cap distribution subsidiary, EUR 140M revenue, ransomware: * Forensic and reconstruction: EUR 325K * Business interruption over 17 days of partial shutdown: EUR 1.2M * GDPR legal fees (4,200 person notifications): EUR 35K * Crisis communication: EUR 45K * Total: EUR 1.605M * Cyber policy (EUR 2M limit, EUR 50K deductible): indemnification EUR 1.48M
Case 3: Large French financial services operation, EUR 580M revenue, data leak: * Forensic and reconstruction: EUR 850K * Business interruption: EUR 4.2M * GDPR legal fees (280,000 person notifications): EUR 320K * CNIL sanction: EUR 1.8M * Crisis communication and reputation: EUR 980K * Total: EUR 8.15M * Cyber policy (EUR 15M limit, EUR 250K deductible): indemnification EUR 7.1M
Cases from ANSSI reports, IBM Cost of a Data Breach 2024, Mandiant M-Trends 2024.
Have CBE Consulting assess your French cyber financial exposure
Our consultants offer:
- A free personalized assessment based on your size and sector
- An estimate of your French maximum plausible cyber loss
- A costed recommendation for prevention and insurance investment
No commitment, by video, 30 minutes.
Phone: +33 9 80 43 16 34 Email: secretariat@cbeconsulting.fr
7. Frequently asked questions
What is the average cost of a cyber attack in France in 2026? Per IBM Cost of a Data Breach 2024, the average cost for a French organization is EUR 4.17M, up 12% vs. 2023. By size: small ~EUR 60K, SME EUR 230K, mid-cap EUR 1.8M, large operations EUR 7M. Sectoral variations are significant: x 1.8 for financial services, x 1.4 for retail, x 1.1 for industry.
Which item represents the largest cost of a cyber incident? Business interruption during operational shutdown represents 40-55% of total cost of a major cyber incident. For a French mid-cap at EUR 100M revenue with 20 days of partial shutdown, gross margin loss ranges between EUR 800K and EUR 2.5M. Followed by forensic and reconstruction (25-35%), GDPR legal fees (8-12%), crisis communication (5-8%), and potential ransom (5-15% when paid).
How much should we invest in preventive cybersecurity? For a French mid-cap, recurring annual investment in preventive cybersecurity ranges between 0.5% and 2% of revenue. So EUR 110-440K per year for a French subsidiary at EUR 50M revenue. Typical breakdown: MFA, EDR, outsourced SOC, immutable backups, phishing training, annual audits. ROI is positive at first loss avoided or well-managed.
How much does cyber insurance covering a major incident cost? For a French mid-cap wanting EUR 5-10M limit covering complete cyber incident: EUR 25-80K/year premium per risk profile, sector, and cybersecurity disposition quality. A mature mid-cap obtains 25-40% better conditions. Cost is marginal vs. major loss cost (average EUR 1.8M for a French mid-cap).
Does cyber insurance really reimburse these costs? Yes, provided the contract is properly dimensioned and subscription conditions respected. In practice, a modern French cyber policy indemnifies 80-95% of total cost of a well-managed cyber loss. Limits: deductible (EUR 5-100K), sub-limits per coverage, global limit, classic exclusions (war, OFAC sanctions, gross negligence). Fast declaration to insurer (within 24 hours) conditions good handling.
How to compare to other companies in our sector? Four main benchmark sources: ANSSI Panorama de la cybermenace, IBM Cost of a Data Breach Report, Hiscox Cyber Readiness Report (SME-mid-cap), and sectoral benchmarks published by professional federations. For personalized diagnostic per your exact profile (size, sector, geography, maturity), an audit by an independent consulting broker or specialized firm brings precise quantification.
About the author: Jean-Georges NANOT
Jean-Georges NANOT is consulting broker and founder of CBE Consulting, an insurance broking firm based in France specialized in international risk management. He advises French ETIs with international activity and foreign-headquartered subsidiaries in France on insurance program structuring, risk audits, and claims management.
ORIAS no. 15000172 LinkedIn: [to be completed] View all articles by this author
About this article
This article was written by Jean-Georges NANOT to provide expert insight on the topic discussed. The information presented is of a general nature and does not replace a personalized audit. Each situation requires specific analysis of your risk exposure. For an assessment adapted to your company, contact our team.
CBE Consulting, Cap de Bonne-Espérance Consulting, insurance broker. ORIAS no. 15000172 Supervisory authority: ACPR, 4 place de Budapest, 75009 Paris, France.
Sources and references
- ANSSI, Panorama de la cybermenace 2024 and 2025
- IBM Cost of a Data Breach Report 2024
- Hiscox Cyber Readiness Report
- ENISA Threat Landscape 2024
- Cybermalveillance.gouv.fr
- CNIL, GDPR recommendations
- Mandiant M-Trends 2024
- ACPR
Featured Industries
Become an Expert!
Get the latest insights from our newsletter.
Free 31 page Blueprint For Consultants
Complex situation, changing demands and dynamic market environment make today's business even more challenging.