Guides · Cyberattack · First steps
Cyberattack in France: Police, CNIL and Insurance Deadlines
After a cyberattack, three steps can pile up: filing a police report, notifying the CNIL (France’s data protection authority) and reporting the loss to your insurer. Their deadlines and starting points are different.
The short answer
After a cyberattack, check three independent steps right away:
- File a police report within 72 calendar hours if your company has cyber insurance and the incident falls within the scope of Article L. 12-10-1 of the Insurance Code (code des assurances). A late report can cost you your right to compensation.
- Notify the CNIL within 72 calendar hours when a personal data breach is likely to put the people concerned at risk. The clock starts when the company becomes aware of the breach.
- Report the loss to your insurer within the deadline written in the policy. That deadline cannot be shorter than five business days.
Write down separately the time the incident, the possible data breach and the loss were each identified. These three moments may be close together, but they are not automatically the same. In parallel, preserve the evidence and start containing the incident.
Write down your starting times
Note the time of the first sign you observed, the time the incident was confirmed and, if different, the time a possible personal data breach was identified. Add the name of the person who made each finding. This timeline will help you explain your decisions to the police, the CNIL and your insurer.
If you control the affected equipment, isolate it from the network without switching it off. Deleting files, reinstalling the site or abruptly powering off a machine can wipe out the logs and other evidence needed to understand the intrusion. Work on a copy; keep the original as it is.
Which deadline applies to your situation?
The three steps do not automatically apply to every incident. An attack that makes files unavailable without touching personal data may not require a CNIL notification. Conversely, an email sent to the wrong recipient can be a data breach even though no one broke in. So examine each column separately.
| Police report for compensation | Notification to the CNIL | Notification to the insurer | |
|---|---|---|---|
| Starting point | Awareness of the intrusion | Awareness of the data breach | Awareness of the loss |
| Deadline | 72 calendar hours | 72 calendar hours | At least 5 business days, or the policy’s deadline |
| Nature | Legal condition for payment of compensation | Legal obligation | Contractual obligation |
| Applies if | You have cyber insurance, and the intrusion falls under Articles 323-1 to 323-3-1 of the Criminal Code (code pénal) | A personal data breach is likely to put people at risk | A loss covered by the policy has occurred |
| If the deadline is missed | Payment of compensation is not due | Fine of up to €10M or 2% of worldwide revenue | Possible loss of coverage, only if harm is proven |
See the technical detail: preparing the incident file
Build an incident file you can actually use
Keep enough evidence for the technical work, the police report, the CNIL notification and the insurer notification to all rest on the same timeline.
- Open a single timeline. For each event, record the date, the time, the time zone, who observed it and what was done. Keep the first sign observed, the confirmation of the incident and the discovery of a possible data breach as separate entries.
- Keep the originals before fixing anything. Ask for a copy of the site and its database, then export the available logs: server access and errors, authentication, firewall or CDN, email, hosting administration and DNS changes. Keep one copy untouched and work on a duplicate.
- Map the data that was reachable. List the forms, customer accounts, databases, storage spaces, backups and mailboxes that the compromised account or system could access. For each set, note the type of data, the approximate number of people concerned and what remains uncertain.
- Keep the evidence separate from the recovery work. Record the passwords changed, sessions revoked, keys reset, files deleted and services shut down. This list shows what was altered after the initial copy.
- Prepare four outputs from the same file. The police need the facts and the evidence of the intrusion; the CNIL, the data and the risks to individuals; the insurer, the circumstances, the measures taken and the cost; your provider, what it needs to contain and then fix the incident. The factual base stays the same; only the presentation changes.
File a police report within 72 hours
Since April 24, 2023, a company with cyber insurance must file a police report within 72 hours of becoming aware of the intrusion to keep its right to compensation. This rule covers intrusions into an IT system under Articles 323-1 to 323-3-1 of the Criminal Code (code pénal). It does not create a general obligation for every company hit by an incident to file a report.
A company cannot file a hacking complaint online through THESEE. Go to a police station or gendarmerie with the Kbis extract (the company registration certificate), the legal representative’s ID and, if someone else goes in their place, a dated and signed power of attorney. You can also write to the public prosecutor (procureur de la République); keep proof of sending and its date.
The service you approach must record the complaint. The public 17Cyber service can guide the company and put it in touch with a police officer or gendarme, but that exchange does not replace filing a complaint.
If you are late, the legal consequence is that payment of compensation is not due. This mechanism is separate from a contractual clause that voids coverage (déchéance de garantie).
What not to do
- Trying to file a complaint on the company’s behalf online through THESEE
- Substituting a simple police log entry (main courante) for the complaint
- Waiting until you know the total amount of the loss
- Altering or deleting evidence before keeping a copy
Assess, then notify the CNIL within 72 hours
An intrusion into, loss, alteration or disclosure of personal data is a data breach. Assess right away the possible consequences for the people concerned. If the breach is likely to put them at risk, notify the CNIL within 72 hours of the moment the company became aware of it.
The clock runs in calendar hours, weekends included. If you do not have all the information yet, you can complete the notification later; the technical investigation must not delay the first report.
The notification procedure, the decision grid and the information to provide belong in a dedicated guide. Here, the priority is to start the process within the deadline and document your decision.
Report the loss to your insurer
Read the policy’s special conditions as soon as the incident begins, and report the loss within the deadline stated there. The Insurance Code sets a minimum of five business days; the policy may grant more, never less.
This deadline is separate from the two 72-hour deadlines. A late report lets the insurer deny coverage only if it proves the delay caused it harm. That forfeiture does not apply when the delay results from an unforeseeable event or force majeure.
Why cost estimates vary so widely
The published figures for the cost of a cyberattack do not all measure the same thing. Some report the compensation paid out after the deductible, others the cost reported by companies, and others still the data breaches suffered by large organizations. Comparing them without stating their method produces gaps of several orders of magnitude.
For companies with fewer than 50 employees, the available data puts the average compensation paid between €3,100 and €9,400, and the median reported cost between €4,900 and €8,700. These two measures converge on a few thousand euros, but they describe neither the same expenses nor all companies. The table below gives the exact scope of each figure.
| Source | Amount | What it actually measures |
|---|---|---|
| AMRAE, compensation paid in 2025 (micro-companies, revenue under €2M) | €3,127 | Average compensation paid per claim, deductible subtracted — not the total cost |
| Hiscox, reported cost 2022 (0 to 9 employees) | €4,900 | Median cost reported by affected companies, all causes |
| Hiscox, reported cost 2022 (10 to 49 employees) | €8,700 | Same measure, larger headcount bracket |
| Asterès/CRiP, average cost 2022 (SMEs excluded from the calculation) | €59,000 | Does not measure small and mid-sized businesses: they are explicitly excluded from the calculation and only counted in the volume |
| IBM/Ponemon, data breaches 2025 (France) | €3.59M | Average cost of a data breach at large organizations — not an ordinary cyberattack on a small business |
Reduce the risk of a repeat
Once the steps are under way, continue the investigation and the recovery: identify the entry point, reset the compromised credentials, check email forwarding rules and restore from a tested backup. Record the decisions made and update your internal procedure while the difficulties you ran into are still fresh.
What to ask your insurer and your provider
What exact deadline does our policy set for reporting this loss, and where must we send the report?
A number of days, a cutoff time and the written contact details of the receiving department.
Does the incident fall within the policy’s coverage, and what documents must we submit to open the file?
Written confirmation of the coverage that applies and a list of documents, not a general verbal answer.
Was a complete copy of the systems, logs and database kept before the first intervention?
The date of the copy, its location, its scope and the name of the person who made it.
What personal data may have been lost, altered or viewed, and what is that analysis based on?
One answer per application, table, form or mailbox, with the uncertainties still open.
Who is responsible for filing the police report on the company’s behalf, with what authorization and before what cutoff time?
A name, a dated and signed power of attorney, the list of supporting documents and the calculated deadline.
Sources
- CNIL — Notifier une violation de données personnelles (Reporting a personal data breach)
The CNIL’s 72-hour deadline, its starting point, and the penalty regime.
- CNIL — Les pouvoirs de la formation restreinte (The powers of the restricted committee)
The exact GDPR penalty amounts, and the tier a failure to notify falls under.
- Légifrance — Article L. 12-10-1 du code des assurances (Insurance Code)
The full text of the 72-hour police report condition.
- Légifrance — Article L113-2 du code des assurances (Insurance Code)
The deadline for reporting a loss to the insurer, and its five-business-day floor.
- Entreprendre.Service-Public — Fiche officielle sur le délai de 72 heures (Official 72-hour deadline sheet)
Confirms the starting point of the deadline and the consequence of a late police report.
- Ma Sécurité — THESEE
Confirms that the service is reserved for individuals, not companies.
- Cybermalveillance.gouv.fr — Lancement de 17Cyber (Launch of 17Cyber)
The exact scope of the service: guiding victims, not replacing the filing of a complaint.
- AMRAE — LUCY 2026, lumière sur la cyberassurance (LUCY 2026, spotlight on cyber insurance)
The average compensation actually paid, by company size, in 2025.
- Hiscox — Rapport sur la gestion des cyber-risques 2023 (Cyber readiness report 2023)
The median cost reported by affected companies, by headcount bracket.