On 5 May 2017, two days before France’s presidential runoff, hackers dumped at least 9 gigabytes containing 21,075 emails and other files linked to Emmanuel Macron’s En Marche! campaign. The campaign said the material had been fraudulently obtained and that forged documents had been mixed with genuine communications to create confusion. Numerama’s review described the contents as largely mundane, including bills, loans, reservations, personal messages, and campaign correspondence, rather than evidence of the alleged tax evasion and election fraud promoted online.
The leak became consequential because social platforms and anonymous forums accelerated its distribution during France’s legally mandated 44-hour election media blackout. The hashtag #MacronLeaks reached 47,000 tweets within three and a half hours; the ten most active accounts produced more than 1,300 posts, with bot activity suspected. WikiLeaks amplified the material 15 times, while American alt-right activists including Jack Posobiec helped circulate it through Twitter, Facebook, 4chan, and translated media. Flashpoint assessed with moderate confidence that APT28, linked to Russian military intelligence, was responsible, citing metadata and operational similarities, but France’s cybersecurity chief Guillaume Poupard said on 1 June 2017 that the hack was generic enough to have been conducted by practically anyone. Macron won the runoff by about 32 percentage points, and the episode reinforced investigations into foreign digital interference without establishing a definitive public attribution.
