On 5 May 2017, two days before France’s presidential runoff, Emmanuel Macron’s campaign reported a “massive hack.” More than 21,000 emails and approximately 9 gigabytes of files were posted anonymously to Pastebin and then circulated through 4chan, Twitter, Facebook and WikiLeaks. The campaign said genuine material had been mixed with forged documents to create confusion and misinformation. A review by French technology publication Numerama found mostly mundane material—memos, bills, reservations and private correspondence—rather than evidence of the alleged tax evasion or election fraud.
The technology scandal was amplified by coordinated online activity. #MacronLeaks reached 47,000 tweets in three and a half hours; Jack Posobiec’s account rapidly retweeted the hashtag, while the ten most active accounts produced more than 1,300 posts in roughly three hours. Flashpoint assessed with “moderate confidence” that APT28, also known as Fancy Bear, was involved, and metadata reportedly pointed to a Moscow-linked contractor. However, Guillaume Poupard, head of France’s cybersecurity agency, said on 1 June that the hack was so generic it could have been conducted by almost anyone. The French election commission warned that redistributing the material could violate the pre-election media blackout. Macron won on 7 May by 32 percentage points, and the leak appeared not to change the result, but the incident became a major example of hacked materials, forged content and platform automation being combined to target an election.
