Renault's factory at Douai on the Channel coast was closed for the day on Monday as technicians took "preventive" action after the attack hit the company's computer systems at the weekend.
About 3,500 employees were laid off for the day or told to take a holiday.
Anssi boss Guillaume Poupart said on Monday that "of course" there were other victims in France, although no other name have been made public.
"We are working with them, we're really trying to restore [their computer systems] as quickly as possible in the most difficult cases," he told France Inter radio.
Later in the day the agency said that it was aware of fewer than 10 other cases.
Mafias move to cybercrime
The attack is estimated to have hit 200,000 victims in 150 countries, the European police authority Europol said at the weekend.
Poupart joined other experts in warning that there will be regular copycat attacks over the next few weeks.
"The attackers are updating their software, improving their performance, other attackers are copying their methods to launch attacks for their own benefit," he said.
The authors of the WannaCry ransomware have not been identified but Poupart declared they were obviously criminals.
"Some mafias who used to deal in drugs or other contraband are attacking information technology today because it's easier, costs less, is a lot less risky and is extremely profitable," he added.