On 5 May 2017, two days before France’s presidential runoff, roughly 9 gigabytes of data and 21,075 emails from Emmanuel Macron’s En Marche! campaign were dumped on Pastebin and rapidly reposted to 4chan, Twitter, Facebook, and WikiLeaks. The campaign said genuine material had been mixed with forged documents to create confusion. Numerama’s review found mostly mundane private correspondence, bills, memos, and reservations, rather than evidence of the criminal wrongdoing alleged online. French electoral law then imposed a 44-hour pre-election media blackout, limiting the campaign’s ability to respond; the leak did not prevent Macron’s victory on 7 May by a 32-point margin.
The incident’s broader impact came from coordinated amplification. The hashtag #MacronLeaks reached 47,000 tweets in three and a half hours, while ten highly active accounts produced more than 1,300 posts and some activity suggested automated bot use. Flashpoint assessed with moderate confidence that Russia-linked APT28, also known as Fancy Bear, was responsible, citing metadata and tactics; Le Monde later reported that Google and FireEye analyses attributed the operation to the GRU. However, France’s cybersecurity chief Guillaume Poupard said on 1 June that the hack was generic enough to have been conducted by almost anyone, and Russia denied interference. French authorities investigated, while the election commission warned media and citizens not to circulate the material because doing so could distort the ballot.
