TL;DR for the dev/security crowd: Even mom-and-pop shops in rural France are getting hammered by AI voice clones, BEC, and ransomware. Here are the 5 attack patterns I see weekly as a Cybermalveillance.gouv.fr-referenced technician in the Sarthe region — and the cheap, repeatable hardening steps I deploy for clients running fewer than 10 endpoints.

When a baker in Arnage (a small town near Le Mans) calls me on a Tuesday morning because his point-of-sale won't boot, I usually know within five minutes what I'll find. Black wallpaper, broken-French ransom note, .onion URL. The week before, it was a freelance designer in Coulaines who'd received a call from "Microsoft" asking for remote access to "fix a license issue." She said yes. €3,200 wired out of her business account the next day.

I'm an independent IT technician based in Le Mans, France, running a one-person shop called Fix72. I'm referenced by Cybermalveillance.gouv.fr — the French national victim-support program for cybercrime — which means I see a steady stream of incidents at small businesses (artisans, freelancers, retailers) across the Sarthe department. In 2026, the threat landscape for the smallest organizations is worse than for enterprises, not better. They're the soft underbelly.

According to a CPME study widely cited in French press, 60% of SMBs that get breached file for bankruptcy within six months. Not because attackers stole millions — most ransom demands are €500–€3,000 — but because the indirect losses (customer data, accounting files, in-flight quotes, reputation) finish off cash-strapped operations.

Here are the 5 patterns I encounter weekly, with the practical mitigations I actually deploy.

1. Fake Microsoft / Apple / Bank Tech Support

Pattern. Phone call, often in fluent French thanks to AI voice synthesis, sometimes with a foreign accent. "Microsoft technician" claims your machine is sending error reports to their servers. Wants you to install AnyDesk or TeamViewer for "diagnosis." Once connected: mailbox dumped, files exfiltrated, online accounts hijacked.

Mitigation.

• User-facing rule: no legitimate vendor cold-calls you asking to install remote-access software. Hang up. Call back via a number you find yourself on the official site.
• Technical rule: block AnyDesk/TeamViewer/UltraViewer at the firewall by default for non-IT users. Whitelist on a per-need basis.

Incident response cheat sheet. Disconnect network cable / Wi-Fi immediately. Uninstall the remote-access tool. Rotate credentials from a clean device. File a report on Cybermalveillance.gouv.fr.

2. "Unpaid invoice" / "Stuck parcel" Phishing

Pattern. Email purporting to be from La Poste, Chronopost, URSSAF (French social-security collector), the user's accountant, or a real supplier. In 2026 these are near-perfect: real logos, professional French, sometimes the recipient's company name pulled from a leaked dataset.

Mitigation.

• Hover before clicking. laposte-clients.com is not laposte.fr.
• For invoices from suppliers: confirm by phone using a number the user already had, not one in the email.
• Push 2FA on email accounts (this single change kills most account-takeover follow-ons).

3. Ransomware via Office/PDF Attachment

Pattern. Attachment apparently from a client, a prospect, or a French tax authority. User opens it. Nothing happens — for 24-72 hours. Then on Monday morning every file has a .locked or .crypt extension and a README.txt demands €800 in BTC.

Mitigation.

• Backup strategy: enforce 3-2-1 (3 copies, 2 different media, 1 offsite). NAS sync alone is not a backup — ransomware encrypts NAS shares too. Use immutable cloud snapshots or rotated offline disks.
• Paying does not guarantee recovery. ~30% failure rate per 2025-2026 IR reports. And it funds the next attack.
• Macro execution off by default in Office, attachment scanning at the mail gateway, EDR with rollback capability if budget allows.

Incident response. Pull the network cable on the infected machine immediately to stop lateral movement to NAS / other endpoints. Photograph the ransom screen for the police report. Don't touch anything else until a pro arrives.

4. Voice Deepfakes — The 2026 Breakout Threat

This is the newest one and it scares me the most. Pattern. A user gets a phone call from their accountant, business partner, or family member. The voice is exactly right. The caller asks for an urgent transfer, a password, or access to a folder. It's not them — it's an attacker who cloned the voice from a few seconds of LinkedIn or Instagram video.

Mitigation.

• Out-of-band verification for any sensitive request received by voice: hang up and call back on the known number.
• Establish a verbal passphrase with co-founders / family for unusual requests. Yes, really. It works.
• During the call, ask a question only the real person could answer (a private detail not posted anywhere).

5. CEO Fraud / Business Email Compromise (FOVI in French)

Pattern. An email apparently from the company director (or a major client) asks an employee — usually accounting — to wire money urgently, confidentially, to an unfamiliar IBAN. Pressing tone, plausible pretext (confidential acquisition, supplier in arrears). This is the favorite scam against small French businesses with one or two employees.

Mitigation.

• Written internal procedure: any new IBAN requires an out-of-band voice confirmation with the director. No exceptions.
• DMARC + SPF + DKIM properly configured on the company domain (most small French businesses still have this misconfigured).
• Banking alert thresholds for any new payee.

The Minimum-Viable Cyber Hygiene Stack for a Tiny Business

If a small business owner can only do five things this week:

1. Enable 2FA on the business mailbox, banking, and accounting software. WebAuthn / passkeys where available, otherwise TOTP.
2. Implement 3-2-1 backups with at least one immutable / offline copy.
3. Patch monthly — Windows, browser, line-of-business apps, and any plugin/extension.
4. Train staff to recognize phishing — 80% of incidents start with a user click.
5. Annual cyber-hygiene audit — DIY via the Cybermalveillance.gouv.fr questionnaires, or hire a local provider.

Why I Wrote This

I'm not a marketing agency. I'm a one-person shop in a French department of ~580,000 people, and I watch tiny businesses go under because they couldn't recover €40k of customer records that were never backed up properly. If you build security tooling for SMBs and want a ground-truth perspective on what's actually hitting non-tech owners in 2026, my inbox is open.

For French-speaking readers in the Sarthe area: I run a free 30-minute cyber-hygiene audit for very small businesses — details at fix72.com/audit-cyber-tpe.

Etienne Aubry — Independent IT technician based in Le Mans (Sarthe, France) since 2015. Cybermalveillance.gouv.fr-referenced. Operating across 94 communes of the Sarthe department.

Originally published in French on Medium.