Sounds like it's going to be a bad one, Mumbai attacks in 2008 demonstrated that a small independent cell is capable of doing a lot of damage in a relatively simple to plan attack with minimal resources. Can easily be planned in any heavily populated area with a lot of foot traffic and by the time the emergency services respond, even if minutes there will be significant casualties.
This is something that's been demonstrated in a number of lone shooter incidents in US and even here recently with Cumbria shootings which left 13 dead. Now bear in mind in the latter the perpetrator wasn't even shooting indiscriminately and killed himself so death count could have been much higher.
Unfortunately this also has a high chance of being an ISIS related/motivated attack with some early reports confirming this. With how long the conflict in places like Syria has been allowed to go on, there is now unfortunately a very big supply of well trained and experienced fighters who wish Europe and US harm. Small cell comprised of such men operating independently is capable of doing a lot of damage and difficult for security services to detect.
Thoughts are with France tonight but unfortunately this looks far from over with a hostage situation already developing.