FR Ministry of Agriculture Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The French Ministry of Agriculture appeared on a list published by the lapsus$ ransomware group on 01 March 2026, confirming the exfiltration of internal files. Individuals who may have interacted with the ministry are advised to review any recent communications from the organisation and follow its guidance on protective steps.
Inside the incident
The incident came to public attention solely through the group’s listing on its leak site. The entry claims exfiltration of internal files but supplies no further technical description, timeline of access, or confirmation of encryption. Public reporting has not yet established whether the ministry has acknowledged the listing or whether any data has been verified as authentic.
Who is lapsus$?
Lapsus$ is a ransomware and data-extortion group that has previously claimed responsibility for intrusions at large technology firms, government contractors and critical-infrastructure operators. Its documented pattern involves initial network access, followed by theft of internal documents and a public listing on a dedicated leak site to pressure the victim. The group’s listings are treated as claims until independently verified by the affected organisation or law-enforcement agencies.
About FR Ministry of Agriculture
The French Ministry of Agriculture is the central government body responsible for agricultural policy, rural development, food safety, forestry, fisheries and animal welfare. It collects and maintains records on farm subsidies, regulatory compliance, research programmes and market oversight. A successful intrusion at such an agency can expose operational data that underpins national food-supply decisions and regulatory enforcement.
The information in question
The only detail released is that “internal files” were allegedly exfiltrated. No inventory of file types, no count of records and no confirmation of personal data have been published. Organisations of this type routinely hold policy documents, subsidy applications, inspection reports and contact information for farmers and businesses; however, whether any of these categories were taken in this case is unconfirmed.
Why it matters
Government ministries hold datasets that affect regulatory decisions and the livelihoods of agricultural producers. Even without confirmed personal identifiers, the release of internal planning or compliance files can reveal sensitive operational practices or create secondary risks if the material is later used for targeted follow-on activity. The absence of a confirmed victim count leaves the scale of any downstream exposure unknown.
What to do if you're exposed
Individuals who have interacted with the ministry through subsidy applications, inspections or regulatory filings should monitor official statements for further guidance. Practical first steps include:
- Reviewing recent account statements and official correspondence for unexpected activity.
- Enabling or strengthening multi-factor authentication on any government-linked portals.
- Running a free exposure scan of your email address against known breach repositories to check for prior appearances of your information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Eiffage Listed by lapsus$ Ransomware GroupOSAC Aero Listed by lapsus$ Ransomware GroupLacoste Listed by lapsus$ Ransomware GroupLille University Listed by lapsus$ Ransomware GroupLatest breaches
Publicly posted by lapsus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.