Disclosure context

About wannacry

WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged. The group has been linked to 33 public disclosures across our corpus. First observed on a leak site on May 12, 2017; most recent post February 23, 2018. The operation is currently inactive.

Also tracked as: WannaCrypt, WanaCrypt0r, WCrypt, WCRY.

Timeline of this disclosure

May 12, 2017Renault listed by wannacryon the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Commercial Facilities sector, which has 20 disclosures indexed across all operators we track. Geographically, Renault is reported in France, a country with 472 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

Renault

Claimed by wannacry · listed 9 years ago

109m

Age

since listed · data leaked

Status timeline

Listed
May 12, 2017
Data leaked

At a glance

Group: wannacry
Status: Data leaked
Country: France
Sector: Commercial Facilities
Listed on leak site: May 12, 2017

About the victim

AI dossier — public-source company profile

Renault is a major French automotive manufacturer headquartered in Boulogne-Billancourt, France, producing and selling passenger cars, light commercial vehicles, and electric vehicles under the Renault and Mobilize brands. The company operates globally and offers a wide range of models including electric, hybrid, and combustion-engine vehicles. Renault is one of Europe's largest automakers by sales volume.

Industry: Automotive Manufacturing & Sales
Address: 122-122 bis avenue du Général Leclerc, 92100 Boulogne-Billancourt, France
Employees: 10000+
Founded: 1899

Attack summary

Severity: medium — Data is listed as published, which implies some exfiltration occurred, but no leak post, no data size, no ransom amount, and no specific data categories are available to confirm the nature or scale of the disclosure. Renault is critical industry but evidence is insufficient to elevate beyond medium.

The WannaCry group claims a disclosed attack against Renault France with a status of data_published; no leak post was captured, so specific claims about encryption or exfiltration scope cannot be confirmed from the available evidence.

medium

Sources

Victim siterenault.fr

Source

Indexed 9 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.