A small French commune confirms a ransomware attack and data theft, days after the extortion actor Kairos claimed it on its leak site
Ville de Libercourt confirms data exfiltration; Ransomware.live recorded a Kairos leak-site claim on the commune two weeks earlier
Analysis
The Ville de Libercourt (Pas-de-Calais, France) announced on 2026-09-15 a ransomware attack in late August 2026 with confirmed exfiltration of personal data, naming no access vector, group or data scope; it notified CNIL and ANSSI and says its IT provider ran the technical checks (FrenchBreaches, 2026-09-16). Ransomware.live recorded the extortion actor Kairos's leak-site claim on the commune on 2026-09-02 (Ransomware.live, 2026-09-02), after claiming the Madrid-region municipalities of Valdemoro in May and Velilla de San Antonio in August (Escudo Digital, 2026-08-21), but no source attributes the Libercourt intrusion to Kairos beyond that listing.
Cited evidence
It is confirmed that personal data was exfiltrated. (translated from French)
Ransomware.live discovered on 2026-09-02 that Ville de Libercourt has been claimed by Kairos ransomware group
Updates2
Neither municipal case identifies a gap in an IT provider's detection or notification: Libercourt says its provider ran the technical checks (FrenchBreaches, 2026-09-16), and Velilla de San Antonio said it had activated its security protocols and was still establishing what happened (Escudo Digital, 2026-08-21). The earlier takeaway's claim that both cases share such a gap, and its reference to limited in-house IT staffing, had no source and are withdrawn.
Ransomware.live states that it "discovered on 2026-09-02 that Ville de Libercourt has been claimed by Kairos ransomware group" (Ransomware.live, 2026-09-02), so the leak-site listing dates from that day or earlier. The takeaway's earlier count of three small municipal administrations claimed by Kairos is withdrawn: no cited source gives a total or the size of those municipalities.
Sources3
Revision history
- Published 2026-09-17T0409Z-intel
- Correction 2026-09-30T0639Z-audit
Priority recalibrated from notable to routine: a French commune ransomware confirmation with no vector, actor tradecraft or behaviour defenders can act on. The body is cut to the confirmed facts: no source identifies a shared IT-provider gap or ties the Libercourt intrusion to Kairos beyond its listing, the summary no longer calls Kairos a data-theft-only actor, the takeaway leads with the decision it supports, and the source reliability matches FrenchBreaches' standing as an aggregator.
Changed: priority body classification sources sourcing_note summary
- Correction 2026-10-11T1307Z-audit
Ransomware.live dates its discovery of the Kairos claim to 2026-09-02, so the listing is dated on or before that day, not on it. The takeaway's count of three small municipal administrations is withdrawn: no cited source gives that count or their size.
Changed: headline summary body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.