Skip to main content
Back to the takedown index

Ragnar Locker disruption

October 2023, Ransomware
Led by Gendarmerie nationale

Extended pass entry, last reviewed August 21, 2026

What was taken down?

Ransomware infrastructure seized across multiple European jurisdictions; leak site taken down.

See what happened

What happened to the people?

Officials reported 1 apprehended.
Group accounted for: Partial

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

A French-led international operation, with infrastructure seizures in the Netherlands, Germany, and Sweden, disrupted the Ragnar Locker ransomware group.

Date
October 2023
Target
Ragnar Locker, ransomware group
Activity
Ransomware
Operational lead
French Gendarmerie
Partners
Europol[1]
Jurisdiction
Not established
Outcome
Ransomware infrastructure seized across multiple European jurisdictions; leak site taken down.
Status
Completed
Legal mechanism
Coordinated national judicial/search-and-seizure authority.
Group accounted for
Partial

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Alleged principal developer/administrator arrested in Paris (not publicly named in sources reviewed); five additional suspects interviewed. Recorded as an aggregate count since no name is available, consistent with the project's rule against placeholder person records.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Ragnar Locker ransomware infrastructure disrupted

    Europol, October 20, 2023, Source grade P2

    Establishes the French-led operation and the multi-country infrastructure seizures.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.