Zenidoc Data Breach

Panzer ransomware has claimed Zenidoc, a France-based document management software company, on its leak site on October 13, 2026. This incident marks Zenidoc as one of two French victims identified in this reporting cycle, with Valode & Pistre appearing in the same batch shortly after. As a software provider specializing in document management, Zenidoc’s platform likely hosts sensitive client data, including contracts, financial records, and compliance documents. This inherent characteristic of its service presents a significant downstream risk to its clients, who may face data exposure even without direct involvement in the incident. The reporting period for Panzer’s recent activities in Q3-Q4 2026 indicates a focus on French technology and professional services organizations. The simultaneous claims of two French victims suggest either a deliberate, coordinated campaign or the collective publication of earlier intrusions. Panzer’s historical targeting patterns within France have demonstrably included the technology and architecture sectors during this timeframe, aligning with the profile of Zenidoc and potentially other similar entities in the country.

SOCRadar’s investigation queried the domain zenidoc[.]fr within criminal market sources prior to the Panzer claim and found no associated records. Furthermore, no infostealer-linked initial access signals were detected for this specific domain. The absence of direct telemetry does not confirm that the organization is unaffected, and the most probable entry vectors for such attacks include phishing campaigns, exploitation of vulnerabilities within cloud infrastructure, or credential compromise through unmonitored channels. The limitations of this analysis are important to note. The query covered only available sources, and credentials may exist under alternate corporate domains or use personal email aliases that were not indexed or included in the queried datasets. Additionally, if credentials were compromised and subsequently rotated before indexing, they would not be present in the findings. The lack of observed records in stealer logs does not rule out a compromise, as data may not yet have been indexed or might reside in feeds outside the scope of this particular search. The nature of document management software providers like Zenidoc poses a unique risk. Their platforms can serve as repositories for highly sensitive client information. Therefore, a compromise of the provider can lead to significant data exfiltration affecting multiple downstream clients. Zenidoc’s clients are advised to assess any potential access or exfiltration of documents stored on the platform and to review their compliance obligations, particularly concerning incident notification under regulations like NIS2 for entities operating in France.