Leak at Atos

On 28 December 2024, Atos — the French IT services and digital-transformation group — was named on the leak site of the Space Bears ransomware group, which claimed to have compromised one of the company's databases. The gang, active since April 2024 and known for double-extortion tactics, posted a countdown timer threatening to publish a "company database" around 7 January 2025 unless a ransom was paid.

Atos pushed back publicly within days. In an initial security statement it said early analyses showed no signs of compromise or malware affecting any Atos or Eviden systems in any country, and that it had received no ransom demand. The claim landed at a sensitive moment, as Atos was negotiating the sale of strategic assets to the French government.

In a 3 January 2025 follow-up, Atos confirmed its own infrastructure had not been breached. It concluded that an external third-party system — unconnected to Atos and neither managed nor secured by it — had been compromised by Space Bears, and that this system merely held data referencing the company. Atos declined to identify the third party or the specific data involved.

• Claimed target: an Atos-referencing database
• Threat actor: Space Bears ransomware group (double extortion)
• Actual exposure: data held on a compromised external third-party infrastructure
• Atos internal systems: no evidence of compromise

Status: contained. Atos publicly denied any breach of its own environment; no confirmed record count or ransom payment has been reported.