Advertising agencies face rising cyber threats

Advertising agencies and creative studios are increasingly targeted by cybercriminals due to the sensitive data they handle for multiple clients. These agencies often manage several databases, making them appealing targets since a single breach can expose data from multiple organizations.

Smaller agencies are more vulnerable

Smaller agencies are particularly at risk because they may lack the robust cybersecurity measures found in larger corporations. In January, attackers breached a subcontractor linked to ManoMano, gaining access to client names, email addresses, phone numbers, and conversation histories. The incident was reported to French data protection and cybersecurity authorities.

Regulatory scrutiny increases

French regulators are closely monitoring the marketing and communications sector. In May 2025, Solocal Marketing Services was fined 900,000 euros for issues in its sales prospecting campaigns, though this penalty was related to consent violations rather than a hacking incident.

Email is a common attack vector

Cybercriminals frequently use email to exploit vulnerabilities, as agencies often communicate with journalists, influencers, and suppliers. This makes it challenging to detect fraudulent messages. An attacker can mimic an invoice or an urgent request, and a single click on an attachment can grant access to internal systems.

Vulnerable platforms and practices

Other vulnerabilities include poorly secured Meta Business or Google Ads accounts, which can allow access to clients' advertising budgets. Password reuse across platforms can lead to multiple account compromises. Freelancers and external collaborators using personal computers may also introduce risks if their devices are not adequately protected.

Cyber threats are on the rise

According to Cybermalveillance.gouv.fr, account hacking is the most reported threat in 2025, with a 52% increase compared to the previous year. Data breaches and computer intrusions have also risen sharply by 40% and 112%, respectively, while fraudulent transfers have increased by 93%. Agencies, which manage large advertising budgets, are especially exposed to these risks.

Many agencies lack proper defenses

A 2025 survey by Cybermalveillance.gouv.fr found that 16% of small and medium-sized enterprises had suffered a cyberattack in the past year, and 22% had no backups of their data. Most of the respondents spent less than 2,000 euros annually on information security.

Preventive measures are critical

To reduce risks, agencies are advised to separate administrative access, enable two-factor authentication, use password managers, and regularly update software. Backing up data outside the main system and ensuring subcontractors follow strong security practices are also essential. Training teams to recognize suspicious links and unusual requests can help identify threats that automated systems might miss.

Failure to report breaches can be costly

Failing to report a data breach to the CNIL within 72 hours can result in fines up to 10 million euros or 2% of global turnover. This penalty adds to the financial losses from hacking incidents, emphasizing the need for prompt and transparent reporting.