CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Ville de Libercourt ransomware/data-theft incident (2026-08)

incident · incident:libercourt-kairos-ransomware-breach-2026-08 single-source

Ville de Libercourt (Pas-de-Calais, France) confirmed on 2026-09-15 a ransomware attack in late August 2026 with personal-data exfiltration, thirteen days after the extortion actor Kairos listed the commune on its own leak site (2026-09-02, no data volume stated). The commune does not confirm the responsible group, entry vector, or data scope; CNIL and ANSSI notified.

Coverage
1
first 2026-09-17 → last 2026-10-11
Latest activity
2026-09-17
Ville de Libercourt confirms data exfiltration; Ransomware.live recorded a Kairos leak-site claim on the…
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector · regions: europe
Sources cited
3
3 hosts

Defender insights

What each entry about Ville de Libercourt ransomware/data-theft incident (2026-08) tells a defender to do, newest first.

2026-09-17ROUTINEVille de Libercourt confirms data exfiltration; Ransomware.live recorded a Kairos leak-site claim on the commune two weeks earlier

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-09-17A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak site
    active-threatsVille de Libercourt confirms data exfiltration; Ransomware.live recorded a Kairos leak-site claim on the commune two weeks earlier

Hunting pivots

Tags
data-breachorganized-crimeransomware
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ImpactData Encrypted for Impact

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-09-17/kairos-libercourt-commune-ransomware-confirmed · ATT&CK page ↗

Entries about Ville de Libercourt ransomware/data-theft incident (2026-08) (1)

2026-09-17 · view entry permalink →

ROUTINEupdatedNATOC2

A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak site

The Ville de Libercourt (Pas-de-Calais, France) announced on 2026-09-15 a ransomware attack in late August 2026 with confirmed exfiltration of personal data, naming no access vector, group or data scope; it notified CNIL and ANSSI and says its IT provider ran the technical checks (FrenchBreaches, 2026-09-16). Ransomware.live recorded the extortion actor Kairos's leak-site claim on the commune on 2026-09-02 (Ransomware.live, 2026-09-02), after claiming the Madrid-region municipalities of Valdemoro in May and Velilla de San Antonio in August (Escudo Digital, 2026-08-21), but no source attributes the Libercourt intrusion to Kairos beyond that listing.

It is confirmed that personal data was exfiltrated. (translated from French)

Ville de Libercourt (relayed by FrenchBreaches)

Ransomware.live discovered on 2026-09-02 that Ville de Libercourt has been claimed by Kairos ransomware group

Ransomware.live 2026-09-02
Correctionrun 2026-09-30T0639Z-auditprioritybodyclassificationsourcessourcing_notesummary

Neither municipal case identifies a gap in an IT provider's detection or notification: Libercourt says its provider ran the technical checks (FrenchBreaches, 2026-09-16), and Velilla de San Antonio said it had activated its security protocols and was still establishing what happened (Escudo Digital, 2026-08-21). The earlier takeaway's claim that both cases share such a gap, and its reference to limited in-house IT staffing, had no source and are withdrawn.

Correctionrun 2026-10-11T1307Z-auditheadlinesummarybody

Ransomware.live states that it "discovered on 2026-09-02 that Ville de Libercourt has been claimed by Kairos ransomware group" (Ransomware.live, 2026-09-02), so the leak-site listing dates from that day or earlier. The takeaway's earlier count of three small municipal administrations claimed by Kairos is withdrawn: no cited source gives a total or the size of those municipalities.

Builds on: An encryption-free extortion brand is working through Spanish municipal administrations, where…

incident17 Sep 04:37Zsingle-sourceOpen finding →
Sources: FrenchBreaches · Ransomware.live · Escudo Digital

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • escudodigital.com1 (33%)
  • frenchbreaches.com1 (33%)
  • ransomware.live1 (33%)
All cited sources (3)