When Dassault Aviation files a criminal complaint over acts of damage committed inside the very plant where its fighter jets are assembled, this is no longer an ordinary industrial incident. It is a security breach at the heart of France’s most emblematic weapons program. And what makes this case, which came into sharper focus over the past few days, particularly striking is that it is not an isolated event — it is the visible symptom of a broader pattern affecting military aviation, the nuclear industry, and drone manufacturing all at once.
I looked into the three incidents revealed since February, the way the state has chosen to respond, and what they say about the difficulty of securing a sector that employs more than 200,000 people in France.
What happened at the Cergy plant
On September 25, 2026, Dassault Aviation confirmed it had filed a complaint over acts of damage found at its Cergy site in Val-d’Oise, where Rafale jets are assembled. An employee at the site was taken into custody. The manufacturer did not specify the exact nature of the damage or its impact on the production schedule, but press reporting established that these events were part of a longer sequence: an aircraft under construction had already been found damaged in late 2025, and new acts of malicious damage were identified in June 2026 on the production line, according to reporting later confirmed by several outlets. The damage appears, based on initial findings, to be linked to internal tensions within the company rather than a clearly identified espionage operation.
This was not, however, the site’s first alert. In February 2026, a 19-year-old temporary worker employed as a cable assembler was taken into police custody after being caught in a sensitive area with camera-equipped glasses, as part of an investigation into suspected espionage on behalf of a foreign state. The Cergy plant, which has employed more than 600 workers since summer 2024, was only inaugurated in September 2025 — meaning it has faced two major security incidents in under a year of operation.
Legally, the word sabotage refers to a precise criminal classification. Article 411-9 of the French Criminal Code provides for fifteen years’ imprisonment and a €225,000 fine for anyone who destroys, damages, diverts, or tampers with equipment in a way that undermines the fundamental interests of the nation. The penalty rises to twenty years and €300,000 when the act is committed on behalf of a foreign power or organization. At this stage, neither the public prosecutor nor Dassault Aviation has indicated whether this aggravated classification is being applied.
A month earlier, a theft of strategic material at Framatome
The Rafale case would look like an isolated incident were it not preceded, the month before, by another revealing episode at Framatome, one of the major names in France’s nuclear industry. An employee reportedly stole hafnium, a rare metal that Framatome produces as a high-purity alloy at its Jarrie site, notably for use in naval nuclear propulsion. This metal, a derivative of nuclear-grade zirconium, is used in reactor components, aeronautical turbines, and advanced defense systems because of its exceptional resistance to heat and corrosion. The employee allegedly resold the material for personal gain, with the loss estimated at several hundred thousand euros.
What stands out in this episode is not just the amount involved, but the fact that it concerns a material whose availability directly affects strategic programs such as the Suffren-class nuclear attack submarines, built by Naval Group with the CEA and Framatome as industrial partners. A theft that looks, at first glance, like personal enrichment exposes a gap in the traceability of materials classified as sensitive.
A sector exposed even in drone manufacturing
The third piece of this sequence concerns the military drone industry, which has grown rapidly since the start of the war in Ukraine. In June 2026, a Belarusian national was arrested after filming a drone manufactured by a company near Toulouse while it was in flight. The footage was allegedly transmitted to Russia, according to investigators. The suspect denies any involvement in an intelligence operation.
This incident highlights a dimension the first two cases don’t directly address: the blurred line between internal wrongdoing and foreign interference. In a sector that includes nine major industrial groups and roughly 4,000 subcontracting SMEs, monitoring every sensitive position becomes as much an organizational challenge as a security one.
A few figures help gauge the scale of the industrial base involved:
- Nine major industrial groups and around 4,000 SMEs make up France’s defense industrial and technological base
- The sector represents approximately 210,000 jobs nationwide
- The Dassault Aviation plant in Cergy has faced two separate security incidents in under a year, one involving suspected espionage
- The estimated loss from the hafnium theft at Framatome runs into the hundreds of thousands of euros
The state’s response to a threat described as hybrid
These incidents come as the government has already taken note of a shifting threat landscape. On September 18, Emmanuel Macron met with the leaders of France’s main political parties at the Élysée Palace to discuss what the government describes as an intensifying Russian hybrid threat, combining cyberattacks, sabotage attempts, and disinformation operations. The president asked the government to prepare a plan to protect critical infrastructure, explicitly including the most sensitive sites within the defense industrial and technological base, against the risk of drone attacks and cyberattacks. Interior Minister Laurent Nuñez stressed that the threat was well documented, while noting that France had so far recorded neither drone overflights nor a major sabotage incident on its territory, unlike Germany, where an attempted drone attack targeted Leipzig airport in August.
It is within this framework that the DGSI, France’s domestic intelligence agency responsible for counter-espionage, is systematically brought in whenever an incident affects a site classified as sensitive, in order to determine whether it constitutes an isolated act, an internal company dispute, or an operation directed from abroad. According to industrial security experts, employee security clearances can be suspended quickly as soon as a weak signal emerges, including behavioral changes detected on social media. Still, distinguishing individual wrongdoing, which appears to be the case in Cergy, from confirmed foreign interference, which investigators suspect in the Toulouse case, can only be settled after lengthy investigation.
What these three cases say, taken together
What strikes me most in putting these three cases side by side is not the individual severity of each incident, but how closely bunched together they are in time. An aviation site targeted twice in under a year, a theft of strategic material in the nuclear sector, a possible leak of footage to a third country in the drone industry: these are three different links in the same chain — France’s defense sovereignty — that turned out to be fragile at roughly the same moment. Whether these acts ultimately stem from workplace tensions, personal greed, or organized interference attempts doesn’t change one underlying fact: the rapid growth of the defense sector, driven by the European geopolitical context, is making it mechanically harder to monitor every position at risk. The question raised by the government’s critical infrastructure protection plan is therefore not just about walls and sensors, but about the human capacity to keep watch over a sector that is hiring faster than it can vet.
FAQ
Has the sabotage at the Cergy Rafale plant been confirmed by the courts?
Dassault Aviation has filed a complaint and confirmed an employee was taken into custody, but neither the company nor the prosecutor’s office has legally classified the acts or specified their impact on production.
Is the hafnium theft at Framatome linked to an espionage operation?
No, based on the information available so far, it appears to be a case of theft for personal financial gain, with the employee reselling the material on his own account.
What penalty applies to sabotage of a defense site in France?
Article 411-9 of the Criminal Code provides for fifteen years’ imprisonment and a €225,000 fine, rising to twenty years and €300,000 if the act serves a foreign power.
Does Macron’s protection plan cover only the defense sector?
No, it covers all critical infrastructure, including water and electricity distribution, in addition to sensitive defense industry sites.
