Jouvet SAS Data Breach

Jouvet SAS, a manufacturing company based in France, has been listed as a victim by the qilin ransomware group. The listing appeared on the group’s dark web portal on September 5, 2026, as identified by SOCRadar’s Dark Web Monitoring service. The company’s sector and geographic location place it within the typical targeting patterns observed for the qilin threat actor, which frequently targets industrial manufacturers in Europe. The qilin ransomware campaign appears to be highly active, with 242 victims posted over the past 60 days. The group’s primary focus remains on the Manufacturing and Professional Services sectors, with a significant concentration of victims in the United States, Germany, and Italy. Jouvet SAS represents an extension of this activity into the French manufacturing industry, aligning with recent European manufacturing victims such as Jone Précision, Groupe Fenwick, Complete Packaging Solutions, and Allied Recycling.

A query performed by SOCRadar using their stealer-log monitoring service for the domain jouvet-sas[.]fr returned no records within the sampled dataset. It is important to note that the absence of records in this specific query does not definitively confirm that the organization has not experienced credential compromise. The data sampled may not encompass all instances of compromised credentials, as logs can exist outside the queried dataset, utilize personal email aliases, or may have been collected and utilized by threat actors prior to indexing. Consequently, the null result from the stealer-log query does not rule out the possibility of credential-based initial access. Threat actors often leverage compromised credentials obtained through various means to gain unauthorized access to corporate networks. Therefore, continued monitoring of the corporate domain is recommended to detect any potential ongoing or future malicious activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.