Nexpublica
Company Details
Linkedin ID:
nexpublica
Website:
Employees number:
511
Number of followers:
23,160
NAICS:
5112
Industry Type:
Homepage:
nexpublica.com
IP Addresses:
0
Company ID:
NEX_2568272
Scan Status:
In-progress
Nexpublica Company CyberSecurity Posture
nexpublica.com
Nexpublica est un acteur historique de l’édition de logiciels pour le secteur public, parapublic, et privé. L’entreprise accompagne plus de 4 000 organismes publics et 1 200 entreprises privées. Grâce à un investissement constant en R&D, une expertise approfondie des métiers publics, et une stratégie d’acquisition ambitieuse, les équipes de Nexpublica conçoivent des logiciels performants, fluides et sécurisés, avec une mission : mettre l’innovation technologique au service du mieux-vivre ensemble. Basée à Clichy (92), l’entreprise, forte de 1 200 experts, dispose également de nombreux bureaux régionaux en France et à l’international, permettant un ancrage local au plus près de ses clients.
Nexpublica A.I CyberSecurity Scoring
Nexpublica Risk Score (AI oriented)Between 700 and 749
Nexpublica
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Nexpublica Global Score (TPRM)XXXX
Nexpublica
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Nexpublica Company CyberSecurity News & History
Past Incidents
2
Attack Types
2
Nexpublica: French software company fined $2 million for cyber failings leading to data breach
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: French Regulator Fines Nexpublica €1.7 Million for Major Data Security Failures In November 2022, users of Nexpublica’s portal discovered they could access sensitive third-party documents, prompting an investigation by France’s data protection authority, CNIL. The regulator determined that the software company’s security measures were severely inadequate, failing to meet basic cybersecurity standards. On December 22, CNIL imposed a €1.7 million ($2 million) fine on Nexpublica France, citing the company’s financial capacity, its lack of fundamental security knowledge, the number of affected individuals, and the sensitivity of the exposed data. The breach underscored systemic vulnerabilities in Nexpublica’s data protection practices, raising concerns over the handling of confidential information. The incident highlights the growing scrutiny of cybersecurity lapses by European regulators, particularly under GDPR, where non-compliance can result in significant financial penalties. Nexpublica’s case serves as a notable example of enforcement actions targeting companies that fail to implement essential safeguards.
Inetum
Ransomware
Rankiteo Explanation
Attack threatening the economy of a geographical region
Description: French IT services firm Inetum Group fell victim to a ransomware attack by the BlackCat ransomware, in December 2021. The attack impacted its operations in France, but soon the company isolated all affected servers and switched off client VPNs. The company immediately took the help of cyber security experts to investigate the incident.
Nexpublica Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Nexpublica
Incidents vs Software Development Industry Average (This Year)
No incidents recorded for Nexpublica in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Nexpublica in 2026.
Incident Types Nexpublica vs Software Development Industry Avg (This Year)
No incidents recorded for Nexpublica in 2026.
Incident History — Nexpublica (X = Date, Y = Severity)
Nexpublica cyber incidents detection timeline including parent company and subsidiaries
Nexpublica Company Subsidiaries
Nexpublica est un acteur historique de l’édition de logiciels pour le secteur public, parapublic, et privé. L’entreprise accompagne plus de 4 000 organismes publics et 1 200 entreprises privées. Grâce à un investissement constant en R&D, une expertise approfondie des métiers publics, et une stratégie d’acquisition ambitieuse, les équipes de Nexpublica conçoivent des logiciels performants, fluides et sécurisés, avec une mission : mettre l’innovation technologique au service du mieux-vivre ensemble. Basée à Clichy (92), l’entreprise, forte de 1 200 experts, dispose également de nombreux bureaux régionaux en France et à l’international, permettant un ancrage local au plus près de ses clients.
Loading...
Nexpublica Similar Companies
DiDi
DiDi Global Inc. is a leading mobility technology platform. It offers a wide range of app-based services across Asia Pacific, Latin America, and other global markets, including ride hailing, taxi hailing, designated driving, hitch and other forms of shared mobility as well as certain energy and vehi
Broadcom's VMware software manages cloud complexity so customers can modernize infrastructure, accelerate app development, and protect workloads, wherever these reside. Our flagship cloud solutions provide the security and performance of private cloud combined with the scale and agility of public c
More than one billion people around the world use Instagram, and we’re proud to be bringing them closer to the people and things they love. Instagram inspires people to see the world differently, discover new interests, and express themselves. Since launching in 2010, our community has grown at a r
Dassault Systèmes
Dassault Systèmes is a catalyst for human progress. Since 1981, the company has pioneered virtual worlds to improve real life for consumers, patients and citizens. With Dassault Systèmes’ 3DEXPERIENCE platform, 370,000 customers of all sizes, in all industries, can collaborate, imagine and create
[24]7.ai
[24]7.ai™ customer engagement solutions use conversational artificial intelligence to understand customer intent, enabling companies to create personalized, predictive, and effortless customer experiences across all channels; attract and retain customers; boost agent productivity and satisfaction; a
Walmart Global Tech
Walmart has a long history of transforming retail and using technology to deliver innovations that improve how the world shops and empower our 2.1 million associates. It began with Sam Walton and continues today with Global Tech associates working together to power Walmart and lead the next retail d
The Facebook company is now Meta. Meta builds technologies that help people connect, find communities, and grow businesses. When Facebook launched in 2004, it changed the way people connect. Apps like Messenger, Instagram and WhatsApp further empowered billions around the world. Now, Meta is moving
At Bolt, we're building a future where people don’t need to own personal cars to move around safely and conveniently. A future where people have the freedom to use transport on demand, choosing whatever vehicle's best for each occasion — be it a car, scooter, or e-bike. We're helping over 200 mill
Intuit
Intuit is a global technology platform that helps our customers and communities overcome their most important financial challenges. Serving millions of customers worldwide with TurboTax, QuickBooks, Credit Karma and Mailchimp, we believe that everyone should have the opportunity to prosper and we wo
.png)
Nexpublica CyberSecurity News
December 30, 2025 11:00 AM
Coupang recovers laptop, Trust Wallets drained, Sax discloses breach
Coupang recovers laptop allegedly thrown into river, Trust Wallet reports 2k+ wallets drained, Sax discloses 2024 data breach.
December 29, 2025 08:00 AM
French software company fined $2 million for cyber failings leading to data breach
France's data protection regulator has fined the software company Nexpublica France €1.7 million ($2 million) for poor cybersecurity...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Nexpublica CyberSecurity History Information
Official Website of Nexpublica
The official website of Nexpublica is www.nexpublica.com.
Nexpublica’s AI-Generated Cybersecurity Score
According to Rankiteo, Nexpublica’s AI-generated cybersecurity score is 706, reflecting their Moderate security posture.
How many security badges does Nexpublica’ have ?
According to Rankiteo, Nexpublica currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has Nexpublica been affected by any supply chain cyber incidents ?
According to Rankiteo, Nexpublica has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does Nexpublica have SOC 2 Type 1 certification ?
According to Rankiteo, Nexpublica is not certified under SOC 2 Type 1.
Does Nexpublica have SOC 2 Type 2 certification ?
According to Rankiteo, Nexpublica does not hold a SOC 2 Type 2 certification.
Does Nexpublica comply with GDPR ?
According to Rankiteo, Nexpublica is not listed as GDPR compliant.
Does Nexpublica have PCI DSS certification ?
According to Rankiteo, Nexpublica does not currently maintain PCI DSS compliance.
Does Nexpublica comply with HIPAA ?
According to Rankiteo, Nexpublica is not compliant with HIPAA regulations.
Does Nexpublica have ISO 27001 certification ?
According to Rankiteo,Nexpublica is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Nexpublica
Nexpublica operates primarily in the Software Development industry.
Number of Employees at Nexpublica
Nexpublica employs approximately 511 people worldwide.
Subsidiaries Owned by Nexpublica
Nexpublica presently has no subsidiaries across any sectors.
Nexpublica’s LinkedIn Followers
Nexpublica’s official LinkedIn profile has approximately 23,160 followers.
NAICS Classification of Nexpublica
Nexpublica is classified under the NAICS code 5112, which corresponds to Software Publishers.
Nexpublica’s Presence on Crunchbase
No, Nexpublica does not have a profile on Crunchbase.
Nexpublica’s Presence on LinkedIn
Yes, Nexpublica maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/nexpublica.
Cybersecurity Incidents Involving Nexpublica
As of January 21, 2026, Rankiteo reports that Nexpublica has experienced 2 cybersecurity incidents.
Number of Peer and Competitor Companies
Nexpublica has an estimated 28,124 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Nexpublica ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Ransomware.
What was the total financial impact of these incidents on Nexpublica ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $1.70 million.
How does Nexpublica detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cybersecurity experts, and containment measures with isolated affected servers, containment measures with switched off client vpns..
Incident Details
Can you provide details on each incident ?
Title: Inetum Group Ransomware Attack
Description: French IT services firm Inetum Group fell victim to a ransomware attack by the BlackCat ransomware in December 2021. The attack impacted its operations in France, but soon the company isolated all affected servers and switched off client VPNs. The company immediately took the help of cybersecurity experts to investigate the incident.
Date Detected: December 2021
Type: Ransomware
Threat Actor: BlackCat
Title: Nexpublica Data Breach Due to Poor Cybersecurity Practices
Description: In November 2022, users of a Nexpublica portal reported they could access documents about third parties. France’s data regulator (CNIL) investigated the incident and found that Nexpublica’s data security program was inadequate. CNIL levied a fine of €1.7 million ($2 million) based on the company’s financial capacity, lack of knowledge of basic security principles, the number of people affected, and the sensitivity of the data processed.
Date Detected: 2022-11
Date Publicly Disclosed: 2022-12-22
Type: Data Breach
Vulnerability Exploited: Inadequate data security program
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Ransomware INE154130322
Systems Affected: Servers, VPNs
Operational Impact: Impacted operations in France
Incident : Data Breach NEX1767101592
Financial Loss: €1.7 million ($2 million)
Systems Affected: Nexpublica portal
Identity Theft Risk: True
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $850.00 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Third-party documents and sensitive data.
Which entities were affected by each incident ?
Incident : Ransomware INE154130322
Entity Name: Inetum Group
Entity Type: IT Services Firm
Industry: Information Technology
Location: France
Incident : Data Breach NEX1767101592
Entity Name: Nexpublica France
Entity Type: Software Company
Industry: Technology
Location: France
Customers Affected: True
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Ransomware INE154130322
Third Party Assistance: Cybersecurity experts
Containment Measures: Isolated affected serversSwitched off client VPNs
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Cybersecurity experts.
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach NEX1767101592
Type of Data Compromised: Third-party documents, sensitive data
Sensitivity of Data: High
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolated affected servers, switched off client vpns and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Ransomware INE154130322
Ransomware Strain: BlackCat
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach NEX1767101592
Regulations Violated: French data protection regulations (CNIL)
Fines Imposed: €1.7 million ($2 million)
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach NEX1767101592
Lessons Learned: Lack of basic security principles can lead to significant financial and reputational damage.
What recommendations were made to prevent future incidents ?
Incident : Data Breach NEX1767101592
Recommendations: Implement robust data security programs, adhere to regulatory requirements, and ensure proper access controls.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Lack of basic security principles can lead to significant financial and reputational damage.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement robust data security programs, adhere to regulatory requirements and and ensure proper access controls..
References
Where can I find more information about each incident ?
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: DataBreaches.netUrl: https://databreaches.netDate Accessed: 2025.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach NEX1767101592
Investigation Status: Completed
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach NEX1767101592
Root Causes: Inadequate data security program, lack of basic security principles
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cybersecurity experts.
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an BlackCat.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on December 2021.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2022-12-22.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was €1.7 million ($2 million).
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Cybersecurity experts.
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Isolated affected serversSwitched off client VPNs.
Data Breach Information
Regulatory Compliance
What was the highest fine imposed for a regulatory violation ?
Highest Fine Imposed: The highest fine imposed for a regulatory violation was €1.7 million ($2 million).
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Lack of basic security principles can lead to significant financial and reputational damage.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement robust data security programs, adhere to regulatory requirements and and ensure proper access controls..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident is DataBreaches.net.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://databreaches.net .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed.
.png)
Latest Global CVEs (Not Company-Specific)
Description
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler. Root causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution. ImpactThis vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to: * Run any shell command. * Exfiltrate environment variables. * Compromise the CI runner to install backdoors or modify build artifacts. Credits Disclosed responsibly by kny4hacker. Mitigation * Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher. * Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher. * Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
Risk Information
cvss3
Base: 8.1
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=nexpublica' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
