{
  "title": "Public digital threat indicators 2025",
  "updated": "2026-08-24",
  "language": "fr-en",
  "notice": {
    "fr": "Les périmètres et définitions diffèrent selon les organismes. Ces valeurs ne doivent pas être additionnées.",
    "en": "Scopes and definitions differ between organisations. These values must not be added together."
  },
  "datasets": [
    {
      "publisher": "ANSSI",
      "period": "2025",
      "scope": "France — événements portés à la connaissance de l'ANSSI",
      "source": "https://cyber.gouv.fr/actualites/panorama-de-la-cybermenace-2025/",
      "metrics": {
        "security_events": 3586,
        "reports": 2209,
        "incidents": 1366,
        "possible_data_leak_events": 460,
        "confirmed_leak_share_percent": 42,
        "targeted_sectors_percent": {
          "education_research": 34,
          "ministries_local_government": 24,
          "health": 10,
          "telecommunications": 9,
          "other": 23
        }
      }
    },
    {
      "publisher": "ANSSI",
      "period": "2024",
      "scope": "France — événements portés à la connaissance de l'ANSSI",
      "source": "https://cyber.gouv.fr/actualites/panorama-de-la-cybermenace-2024-mobilisation-et-vigilance-face-aux-attaquants/",
      "metrics": {
        "security_events": 4386,
        "reports": 3004,
        "incidents": 1361,
        "known_ransomware_victims_percent": {
          "sme_midcaps": 37,
          "local_authorities": 17,
          "higher_education": 12,
          "strategic_companies": 12,
          "other": 22
        }
      }
    },
    {
      "publisher": "ENISA",
      "period": "2024-07-01/2025-06-30",
      "scope": "European Union — incidents analysed by ENISA",
      "source": "https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups",
      "metrics": {
        "incidents_analysed": 4875,
        "ddos_share_percent": 77,
        "phishing_initial_access_percent": 60,
        "vulnerability_exploitation_initial_access_percent": 21.3,
        "hacktivism_incidents_approx_percent": 80,
        "hacktivism_service_disruption_percent": 2,
        "nis2_essential_entities_percent": 53.7,
        "targeted_sectors_percent": {
          "public_administration": 38.2,
          "transport": 7.5,
          "digital_infrastructure_services": 4.8,
          "finance": 4.5,
          "manufacturing": 2.9,
          "other": 42.1
        }
      }
    },
    {
      "publisher": "Cybermalveillance.gouv.fr",
      "period": "2025",
      "scope": "France — parcours d'assistance Cybermalveillance.gouv.fr",
      "source": "https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/rapport-activite-2025",
      "metrics": {
        "victims_assisted": 500000,
        "phishing_request_share_approx_percent": 33,
        "phishing_search_change_percent": 71,
        "fake_bank_adviser_assistance": 15000,
        "fake_bank_adviser_change_percent": 159,
        "bank_transfer_fraud_assistance": 13000,
        "bank_transfer_fraud_change_percent": 196,
        "phone_number_spoofing_change_percent": 517
      }
    }
  ]
}