Cyber Incident Victim: Pierre Fabre
Date:
Mar 2021
Location:
France
Summary
A French multinational pharmaceutical and cosmetics firm experienced a complete production shutdown following a cyberattack that disrupted operations overnight, forcing employees to leave facilities. The REvil ransomware group later claimed responsibility, listing the company among victims who did not meet ransom demands and subsequently leaking internal employee documents. The incident halted manufacturing activities, including production of hygiene products developed during the pandemic.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 30, 2021, the Pierre Fabre Company experienced a disruptive cyberattack that halted all production operations across the multinational pharmaceutical and cosmetics firm. The intrusion occurred around 4:00 AM local time, prompting an immediate shutdown of manufacturing facilities by Wednesday morning. Employees across affected sites were instructed to return home as systems became inoperable, with union representatives confirming widespread work stoppages. The company's production lines—including those manufacturing hydroalcoholic gels and skin creams developed during the COVID-19 pandemic for hospital use—remained paralyzed following the incident. While initial reports from French media outlets did not confirm the attack methodology, the operational disruption suggested significant compromise of industrial control or enterprise systems. No ransom demands or specific threat actor claims were publicly acknowledged during the first two weeks following the attack.
The incident gained additional clarity on April 12, 2021, when the REvil ransomware group listed Pierre Fabre on their data leak site—a platform used to pressure non-paying victims. REvil actors published screenshots of internal company documents, including employee work-related files, indicating successful data exfiltration prior to encryption. This confirmation established the event as a double-extortion ransomware attack, though Pierre Fabre never publicly disclosed whether negotiations occurred or if data restoration efforts were underway. The prolonged production standstill and workforce displacement demonstrated substantial operational impact, particularly affecting the company’s healthcare-focused manufacturing lines established during the global health crisis. REvil’s data leak represented both reputational risk from exposed employee information and potential regulatory implications under European data protection frameworks.