[Back to Ragnar Locker disruption](https://takedownindex.org/takedowns/ragnar-locker-disruption)

# Organizations and roles

October 2023, Ransomware
[Ragnar Locker disruption](https://takedownindex.org/takedowns/ragnar-locker-disruption)

Last reviewed August 21, 2026

The public record puts 2 organizations on this action. Operational lead: French Gendarmerie. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Gendarmerie nationale](https://takedownindex.org/organizations/gendarmerie-nationale), France | Operational lead | Led the coordinated international operation. |
| | [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation) | Coordinator | Coordinated the multinational action. |

## Accountability

### Legal authority

Coordinated national judicial/search-and-seizure authority.

### Ongoing investigation

Group accounted for: Partial. Alleged principal developer/administrator arrested in Paris (not publicly named in sources reviewed); five additional suspects interviewed. Recorded as an aggregate count since no name is available, consistent with the project's rule against placeholder person records.

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026