After the PCF, the same hacker leaks door-knocking files attributed to Renaissance and LFI

On Saturday, October 24, a few hours after putting up for sale a database attributed to the French Communist Party (PCF), a hacker using the alias ChimeraZ posted two new sets of files on a cybercriminal forum. They allegedly come from the websites of Renaissance, the presidential party, and La France insoumise (LFI). These two sets are being distributed for free.

Neither party has confirmed an intrusion so far. The PCF, for its part, confirmed the leak of its members' file after a warning from the state (see our article). Several specialist sites have analyzed the new files: their content is less spectacular than the announced figures, but more sensitive than it seems.

At LFI, the trace of 158,000 doors knocked

The hacker claims 1,270,096 rows for LFI, or 544 MB. According to an analysis by Cyberattaque.org, these are mostly the movement's door-to-door canvassing tools. The main file lists about 1.1 million addresses tied to a campaign, in the format of the Base adresse nationale (France's national address database), which is public. No resident is named in it.

Another file is more revealing. It traces 12,959 activist visits: 158,040 doors knocked, 54,838 opened, with the date and the name or alias of about 200 activists. The campaigns cover the 2026 municipal elections and the 2027 presidential election, and the most recent records date from this week. A last file lists 11,430 local group events, with about 5,000 phone numbers and 911 email addresses of organizers, some of which appear to be already public.

According to Fuites Infos, Manuel Bompard stated on X, on behalf of the movement, that an internal check had found no leak of members' personal data beyond data that was already public, and he referred to a "scraping of public data." The site disputes this reading: in its view, campaign records are not public. Back in May, a database from the activist platform Action populaire had already circulated.

At Renaissance, 4 million addresses and 1,280 named activists

The set attributed to Renaissance contains about 4.16 million rows. Fuites Infos found 4,145,491 addresses in mainland France, spread across 18,761 municipalities, each with the number of voters living there. The total of 9.6 million cited by the hacker adds up these counts: it is not a number of voters. But more than 1.4 million addresses have only one voter, which makes it possible to link them to a household.

Also included are 10,365 activist events created between January 2022 and October 23, 2026, about 3,500 of them non-public, with the location and the organizer's name. About 1,280 activists are named, some with their role in the party. The hacker spoke of "1,547 employees": they are in fact activists, Fuites Infos corrects. The file contains no email address, phone number or password. Renaissance has neither confirmed nor denied.

The same tool behind both leaks?

The site ZATAZ notes that the Renaissance and LFI files have almost identical names. This proves neither a shared vendor nor a common entry point, it cautions. It is also unknown which service was compromised and whether access has now been shut off.

The stakes go beyond the number of rows. Belonging to a party, or being active in one, reveals a political opinion, which the GDPR classifies as sensitive data. If the origin of the files is confirmed, each party will have to notify the CNIL (the French data protection authority).

What to do

The activists and event organizers named are the most exposed. A message that mentions their campaign, their area or a canvassing date can look very credible: be wary of requests for payment, credentials or unexpected meetings, even if they seem to come from the party. Residents whose address appears in these files are not named, but a message mentioning a visit from activists at their door should not be enough to earn their trust.

After the Les Républicains website in mid-October (read our article), this is the fourth political party targeted in a few weeks, six months before the presidential election. It remains to be seen whether the parties will confirm.