France: National Cybersecurity Agency Reports Ransomware Attack Drop in 2025

ANSSI’s 2025 threat report shows a modest decline in reported ransomware incidents (128 in 2025 vs. 141 in 2024) but confirms ransomware and data-exfiltration remain significant threats—SMBs, healthcare and education were heavily targeted; Qilin, Akira and LockBit 3.0 were the most observed strains. The agency attributes part of the decline to law-enforcement operations (notably Operation Endgame) and defensive interventions, warns about exaggeration in data-leak claims, notes fewer DDoS attacks, and raises concern over a blurring of capabilities between nation-state actors and cybercriminals that complicates attribution and increases hybrid-attack risks.