Alleged cyberattack on France’s largest shipbuilder Naval Group raises national security concerns

Naval Group, France’s largest naval defense contractor and a key player in the European defense sector, has reportedly suffered a major cyberattack. A threat actor claiming responsibility for the breach published details on a well-known data leak forum, alleging access to highly sensitive information, including the source code of combat management systems used on French submarines and frigates.

Unlike typical financially motivated breaches where stolen data is sold, the attackers appear to be pursuing extortion by threatening to publicly release the data unless their demands are met. The alleged breach has raised serious concerns given Naval Group’s central role in France’s naval capabilities and national security.

The attackers claim to possess a trove of information, including internal network data, classified technical documents, confidential communications, and access to virtual machines used by developers. Perhaps most concerning is their assertion that they hold source code powering combat systems used aboard France’s most advanced naval vessels.

Cybernews researchers, who analyzed a 13-gigabyte sample of the leaked data, confirmed that the materials appear authentic. The sample reportedly includes multimedia files, contracts, and data allegedly drawn directly from the combat management system. One video, believed to be footage from a submarine monitoring interface, is dated 2003, raising questions about the breadth and recency of the stolen data.

While the precise scale of the breach remains unverified, if confirmed, it could represent a significant compromise of France’s defense infrastructure. Source code and internal system information from CMS platforms are highly sensitive and, in the wrong hands, could jeopardize operational security, requiring extensive reengineering and costly countermeasures.

Naval Group, headquartered in Paris and employing over 15,000 people worldwide, has yet to issue a public response to the breach. The company, which reported over $5 billion in annual revenue, is majority-owned by the French government, with Thales Group as a key stakeholder. Its portfolio includes the design and construction of advanced naval platforms, including France’s only nuclear-powered aircraft carrier, Charles de Gaulle.