France is creating a specialist cyber unit to respond swiftly to serious attacks on government information systems, after a rise in Russian hacking campaigns, disinformation and fake news. The move comes as Paris prepares for the 2027 presidential election and seeks to protect the country’s digital sovereignty.
On 19 August 2026, French prime minister Sébastien Lecornu ordered that the new unit be established within three days, according to a report published by the media. It will be built primarily from staff at France’s National Agency for the Security of Information Systems, known by its French acronym ANSSI, with specialists from the defence and interior ministries and trained reservists brought in when necessary.
The unit is intended to speed up the detection, investigation and neutralisation of intrusions affecting state systems. Officials must submit proposals by 21 August covering its structure, operating rules, budget and chain of command.
A response to a worsening threat
The decision follows a recent cyber intrusion into the systems of France’s General Directorate of Public Finances, or DGFiP, the body responsible for administering the country’s public finances. The incident has added urgency to concerns that government networks are facing attacks which are more frequent, coordinated and difficult to separate from wider influence operations.
Lecornu has described the current cyber threat as “massive, organised and hybrid”. His assessment reflects the growing overlap between hostile states, criminal networks and individual hackers. In this environment, an attack on a public information system can form part of a broader campaign involving disruption, theft, manipulation of information and pressure on public institutions.
Russian activity is a central concern for the French government. The increase in hacking operations, alongside the circulation of disinformation and fabricated stories, has made the protection of France’s information space a question of national sovereignty rather than a narrow technical issue. The new structure is therefore intended not simply to repair compromised systems, but to improve the state’s ability to identify who is targeting it and to respond before an intrusion spreads.
Resources and responsibility
The emergency unit will draw on expertise already held within ANSSI, while allowing the government to assemble a wider pool of capabilities when an attack is judged serious enough to require it. Bringing in personnel from the defence and interior ministries, as well as qualified reservists, is designed to give the response greater depth without relying on a single institution.
Its effectiveness will depend on decisions still to be made. The government’s proposals must settle who can activate the unit, how it will coordinate with existing agencies, what resources it will receive and who will have final command. Those arrangements matter because the central purpose of the new body is speed: delays in detecting or investigating an intrusion can increase the damage to public services and expose further state information.
The announcement builds on an earlier government plan containing 40 urgent measures to strengthen France’s cyber defences. An additional €200m has been allocated to that programme, signalling that Paris sees the threat as requiring a sustained institutional and financial response rather than a temporary operation after a single breach.
Election security and digital sovereignty
The timing is politically significant. France’s 2027 presidential election will take place against a backdrop of more persistent attempts to influence the country’s digital and information environment. Russian-backed hacking groups and influence operations are presented by the French government as a direct challenge to the integrity of that space.
Such activity could become especially consequential if a far-right, Russia-oriented candidate wins the election. The concern is not that cyberattacks alone determine the result, but that hacking, disinformation and the spread of false narratives can distort the conditions in which voters assess political choices and could contribute to a change in France’s geopolitical direction.
The immediate test is whether the new unit can turn the government’s recognition of the danger into a faster and more coherent operational response. Its proposed rules, funding and command arrangements, due by 21 August, will show how far France is prepared to concentrate responsibility for defending its public systems.
How should France balance the need for a rapid central response with the wider scrutiny required when cyber operations affect democratic institutions?
