Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Renault

Claimed by Wannacry · listed 9 years ago

111m
Age
since listed · data leaked

Status timeline

  1. ListedMay 12, 2017
  2. Data leakeddate unknown

At a glance

Group
Wannacry
Status
Data leaked
Country
France
Sector
Commercial Facilities
Listed on leak site
May 12, 2017

About the victim

AI dossier — public-source company profile

Renault is a major French automotive manufacturer headquartered in Boulogne-Billancourt, France, producing and selling passenger cars, light commercial vehicles, and electric vehicles under the Renault and Mobilize brands. The company operates globally and offers a wide range of models including electric, hybrid, and combustion-engine vehicles. Renault is one of Europe's largest automakers by sales volume.

Industry
Automotive Manufacturing & Sales
Address
122-122 bis avenue du Général Leclerc, 92100 Boulogne-Billancourt, France
Employees
10000+
Founded
1899

Attack summary

Severity: medium — Data is listed as published, which implies some exfiltration occurred, but no leak post, no data size, no ransom amount, and no specific data categories are available to confirm the nature or scale of the disclosure. Renault is critical industry but evidence is insufficient to elevate beyond medium.

The WannaCry group claims a disclosed attack against Renault France with a status of data_published; no leak post was captured, so specific claims about encryption or exfiltration scope cannot be confirmed from the available evidence.

medium

Sources

Source

Indexed 9 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About wannacry

WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged. The group has been linked to 33 public disclosures across our corpus. First observed on a leak site on May 12, 2017; most recent post February 23, 2018. The operation is currently inactive.

Also tracked as: WannaCrypt, WanaCrypt0r, WCrypt, WCRY.

Timeline of this disclosure

  • May 12, 2017Renault listed by wannacryon the group's public leak site

Other recent disclosures by wannacry

wannacry has been linked to 33 public victims on Darkfield. A sample of the most recent:

See the full wannacry dossier →

Sector and geography

This disclosure adds to ransomware activity in the Commercial Facilities sector, which has 21 disclosures indexed across all operators we track. Geographically, Renault is reported in France, a country with 612 ransomware disclosures in our corpus.

If your organisation is affected

A listing by wannacry means Renault appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, CERT-FR (France), as required for your jurisdiction.
  • Monitor for the data appearing on wannacry's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.