#Cybercrime Lawyer in France, Based in Paris

Key points

• Cybercrime covers attacks on computer systems, online fraud, identity theft and unfair collection of data.
• Unauthorised access to a system is punishable by 3 years’ imprisonment and a €100,000 fine (Article 323-1 of the French Criminal Code).
• Insured business victim: the criminal complaint must be filed within 72 hours to preserve compensation, under Article L. 12-10-1 of the French Insurance Code (Code des assurances).
• Keep the evidence before reinstalling anything: logs, messages, screenshots, bank statements.
• Offences (délits) are in principle time-barred six years after the facts (Article 8 of the French Code of Criminal Procedure): you have time to act, but evidence disappears quickly.
• Identifying the perpetrators is a matter for the investigating services; the lawyer structures the complaint and your compensation claims.

A cybercrime lawyer assists victims of digital offences: hacking, ransomware, phishing, identity theft, online harassment (in French), transfer fraud. The lawyer identifies the criminal offences involved, organises the complaint, preserves your rights to compensation and advises you on procedural strategy; depending on the facts, several steps may be considered, with the bank, the insurer, the CNIL (French data protection authority) or the judicial authorities. In Paris, Hashtag Avocats assists companies and individuals facing these attacks, in coordination with the authorities in charge of the investigation.

Need a quick opinion? Call the firm on 01 85 73 56 66 or write to us. For prevention and compliance (contracts, GDPR, NIS2), see our business cybersecurity lawyer page.

Which offences count as cybercrime under French law?

Attacks on automated data processing systems

The French Criminal Code punishes attacks on automated data processing systems (STAD) in Articles 323-1 et seq. Unauthorised access to, or remaining in, a system is punishable by 3 years’ imprisonment and a €100,000 fine. Penalties rise to 5 years and €150,000 where data is deleted or modified, or the system is impaired.

Obstructing the operation of a system, the usual classification for ransomware or a denial-of-service attack, is punishable by 5 years and €150,000 (Article 323-2). Fraudulent extraction or transmission of data, typical of file theft, carries the same penalties (Article 323-3). Where committed by an organised gang, penalties reach 10 years and €300,000 (Article 323-4-1). Attempts carry the same penalties (Article 323-7).

Penalties rise to 7 years and €300,000 where the attack targets a personal data system operated by the State (Articles 323-1 to 323-3). The French Supreme Court (Cour de cassation) also penalises merely remaining in a system: a person who got in through a technical failure commits the offence if they stay after discovering that it was protected (Cass. crim., 20 May 2015, No. 14-81.336, published in the Bulletin).

Online fraud

Phishing followed by transfers, fake bank adviser fraud, fake transfer orders: these schemes usually amount to fraud (escroquerie) (Article 313-1 of the French Criminal Code). It is punishable by 5 years’ imprisonment and a €375,000 fine, increased to 10 years and €1,000,000 where committed by an organised gang (Article 313-2). The victim of a fraudulent payment also has remedies against their bank: the French Supreme Court upheld a court of appeal that had ruled out gross negligence by a customer who approved a transaction during a call that spoofed the number of their bank adviser (Cass. com., 23 October 2024, No. 23-16.267). Our analysis of this decision is available in our article on reimbursement of spoofing victims (in French).

Identity theft and unfair collection of data

Online identity theft is punishable by 1 year’s imprisonment and a €15,000 fine (Article 226-4-1 of the French Criminal Code). Collecting personal data by fraudulent, unfair or unlawful means, the criminal side of data violations, carries 5 years and €300,000 (Article 226-18). These offences are frequently combined with the previous ones in the same case.

Victim of a cyber offence: the step-by-step process

Preserve the evidence

Before any restoration, keep the material that documents the attack: connection logs, fraudulent emails with their headers, screenshots, bank statements, exchanges with the alleged perpetrator. A hasty reinstallation destroys traces that are useful to the investigation and to your civil remedies. Formal findings (constats) and backups are decided together with the technical experts.

File a criminal complaint

The complaint is filed at a police station, at a gendarmerie or by letter to the public prosecutor (procureur de la République). For certain frauds, the THESEE platform allows an online complaint. If you are a business insured against cyber risk, the deadline is decisive: Article L. 12-10-1 of the Insurance Code makes compensation conditional on a complaint filed no later than 72 hours after you become aware of the attack. This condition does not apply to individuals outside a business activity. We draft detailed complaints, with the criminal classification and organised exhibits, to give the investigation a usable basis.

The THESEE online complaint is reserved for adult individuals and certain internet scams; a company files its complaint at a police station or gendarmerie. Police officers and gendarmes are required to take your complaint, even if their unit does not have territorial jurisdiction, and must give you a receipt (Article 15-3 of the Code of Criminal Procedure).

Report the attack

A report complements the complaint without replacing it. Unlawful content is reported on the Pharos platform. The Cybermalveillance.gouv.fr service publishes quick-response guides and refers victims to listed service providers. These steps feed the authorities’ knowledge of attacks, even when the perpetrator remains unknown.

Notify the CNIL if personal data is affected

A company that is a victim may itself have obligations. If the attack has compromised personal data and there is a risk to individuals, notification to the CNIL is required within 72 hours (Article 33 of the GDPR). Our personal data breach lawyer page details this procedure and its thresholds.

Obtain compensation

A civil-party claim (constitution de partie civile) lets you seek compensation before the criminal court. A separate civil action remains possible, in particular against parties whose failure allowed or aggravated the damage. Compensation requires proof of loss and of a causal link: every situation is different. A company’s remedies against its provider, subcontractor or insurer are presented on our cyber litigation lawyer (in French) page.

If the prosecutor drops the case or does not respond within three months of your complaint, you can file a complaint with civil-party petition before the investigating judge (Article 85 of the Code of Criminal Procedure). For a délit (mid-level offence), prosecution is time-barred six years after the facts; where the offence was concealed, this period runs from its discovery, up to a limit of twelve years after the facts (Articles 8 and 9-1 of the same code).

Documents to gather before your appointment

A well-prepared file saves time for both the lawyer and the investigators. Gather, without altering them:

• the date and time you discovered the attack;
• the fraudulent emails, text messages and messages, kept as they are (do not delete them);
• dated screenshots, with the address of the pages or profiles involved;
• your bank statements and the references of the disputed transactions, including the beneficiary’s IBAN;
• your exchanges with the alleged perpetrator, the bank or the platform;
• for a company: connection logs, the technical expert’s report, the insurance policy and exchanges with the insurer;
• the receipt for your complaint or report, if you have already taken these steps.

Do not reinstall your devices before filing a complaint: Cybermalveillance.gouv.fr recommends keeping the traces of the attack for the investigation.

Implicated in a cyber case

The firm also acts for people implicated in proceedings relating to digital offences. This assistance covers analysis of the offences under consideration, preparation for interviews and discussion of the technical evidence in the file. Here too, each situation calls for an individual analysis.

The lawyer’s role and the investigators’ role

Identifying and arresting perpetrators is a matter for the investigating services and the judicial authorities, not for the lawyer. No firm can promise identification, or the recovery of funds or data. Our role: classify the facts, build a solid evidential file, approach the right contacts, follow the proceedings and present your compensation claims. Technical investigation is carried out by independent specialist experts, separate from the legal team.

FAQ: cybercrime lawyer

Should you file a criminal complaint after a cyberattack?

Yes, in almost all cases. The complaint triggers the investigation, officially documents the facts and is a condition for insurance compensation for businesses, under Article L. 12-10-1 of the French Insurance Code (Code des assurances). ANSSI (French national cybersecurity agency) recommends filing a complaint before reinstalling systems, in order to preserve evidence.

How quickly do you need to act?

As soon as possible. For insured businesses, the complaint must be filed no later than 72 hours after becoming aware of the attack, or the insurance payout is lost. If personal data is compromised with a risk to individuals, the CNIL notification follows the same 72-hour timeframe, with a different purpose and recipient. On the criminal side, prosecution of délits (mid-level offences) is in principle time-barred six years after the facts (Article 8 of the French Code of Criminal Procedure).

Can the perpetrator of a cyberattack be identified?

Sometimes, but no professional can guarantee it. Identification relies on investigative powers reserved for the authorities: requisitions, international cooperation, analysis of traces. A well-built complaint improves the chances of success. In parallel, civil remedies exist against identified parties, such as a bank in the case of a fraudulent payment.

What penalties does a cyber offender face?

Penalties depend on the offence. Fraudulently accessing or remaining in a computer system is punishable by 3 years’ imprisonment and a €100,000 fine, rising to 5 years and €150,000 where data is deleted or modified (Article 323-1 of the French Criminal Code (Code pénal)). Fraud (escroquerie), common in online scams, is punishable by 5 years and €375,000 (Article 313-1), and up to 10 years and €1,000,000 when committed by an organised gang (Article 313-2).

Can the police refuse my complaint?

No. Judicial police officers and agents are required to take victims’ complaints, including where their unit does not have territorial jurisdiction, and must issue a receipt (Article 15-3 of the French Code of Criminal Procedure). You can also write directly to the public prosecutor (procureur de la République).

What if my complaint is dropped?

You can file a complaint with civil-party petition before the investigating judge, after the case has been dropped or after three months without a response from the prosecutor (Article 85 of the French Code of Criminal Procedure). This route in principle requires a judicial investigation to be opened. The lawyer first checks admissibility and any deposit (consignation) required.

How much does a cybercrime lawyer cost?

Fees are set in a written fee agreement, signed before any work begins: a fixed fee for a complaint, a fixed fee or hourly billing for following the proceedings and the civil-party claim. They depend on the complexity of the case. Our ways of working are presented on our fees page. If you have legal expenses insurance, check whether it covers this type of dispute.

Penalties vary with the offence: 3 years and €100,000 for unauthorised access (Article 323-1), 5 years and €150,000 for obstructing the system or extracting data (Articles 323-2 and 323-3), 5 years and €375,000 for fraud (Article 313-1). Commission by an organised gang increases these penalties considerably.

Official sources

• Articles 323-1 et seq. of the French Criminal Code (attacks on automated data processing systems): Légifrance (in French)
• Article 313-1 of the French Criminal Code (fraud): Légifrance (in French)
• Article 226-4-1 of the French Criminal Code (identity theft): Légifrance (in French)
• Article 226-18 of the French Criminal Code (unfair collection of data): Légifrance (in French)
• Article L. 12-10-1 of the French Insurance Code (complaint within 72 hours): Légifrance (in French)
• Cass. com., 23 October 2024, No. 23-16.267, published in the Bulletin: Légifrance (in French)
• Ransomware quick-response guide: Cybermalveillance.gouv.fr (in French)
• Guide “Attaques par rançongiciels, tous concernés” (Ransomware attacks: everyone is concerned) (ANSSI-DACG): messervices.cyber.gouv.fr
• Article 323-4-1 of the French Criminal Code (organised gang): Légifrance (in French)
• Article 15-3 of the French Code of Criminal Procedure (taking of complaints): Légifrance (in French)
• Article 85 of the French Code of Criminal Procedure (complaint with civil-party petition): Légifrance (in French)
• Articles 8 and 9-1 of the French Code of Criminal Procedure (limitation period for délits): Légifrance (in French)
• Cass. crim., 20 May 2015, No. 14-81.336, published in the Bulletin: Légifrance (in French)
• THESEE online complaint (internet scams): French Ministry of the Interior

Law in force as at 1 October 2026. This content provides general information and does not constitute legal advice. Every situation is different: contact our team to explain your situation.