File attributed to RN members is circulating, but it appears to be partly reconstructed

On October 31 at 1:41 a.m., a new message appeared on a cybercriminal forum. Its author, who signs as shin0bi, claims to hold 432,597 records linked to the Rassemblement National (RN, France's far-right National Rally party) and is giving away 150,000 of them for free. They released them in a compressed archive named “rassemblementnational_fr_PF.7z”.

At this stage, nothing is confirmed. According to the specialist site Fuites Infos, the RN had made no public statement about the leak as of October 31. The party faces only a claim, and the attribution rests on the hacker's message, the archive's name and the nature of the content.

What does the file contain?

According to analyses published by Fuites Infos and Cyberattaque.org, the records include last names, first names, dates of birth, addresses, landline and mobile numbers, email addresses and occupations. They also include party-specific data: member code, fee category, and dues amounts and dates. Dues dates range from 1984 to October 9, 2026, according to Fuites Infos. The file contains no passwords, bank details or social security numbers.

Why doubts are growing

Both sites, as well as FrenchBreaches, spotted anomalies. Of the 150,000 lines, Cyberattaque.org counts 28,420 exact duplicates, leaving 121,580 distinct lines. Fuites Infos arrives at about 121,300 different people.

The geography is even more puzzling. A record for a resident of the Rhône department is linked to a canton in Toulouse, and another pairs a Toulouse canton with a postal code from the Ain department. Some records list up to eleven cantons. Cross-checks show accurate information on known party members, but also errors, such as an email address that is wrong by two characters.

According to FrenchBreaches, it could be a patchwork of files from different sources, or a database partly reconstructed from several sources. Its exact origin remains unknown. The hacker has not presented any verifiable intrusion method.

In July, the RN acknowledged that its website had been hacked and denied any massive leak of personal data; the Paris prosecutor's office opened an investigation. Nothing links that episode to the October 31 file. In late October, other parties were targeted by claims attributed to another hacker, such as the Communist Party, then Renaissance and LFI.

What to do if you are or were a member

Even if partly false, a file like this can be put to use. Party membership reveals a political opinion, a sensitive category of data protected by Article 9 of the GDPR. The risks are harassment, pressure and phishing.

• Be wary of emails and text messages asking for dues, a donation or an update of your contact details in the party's name: use only its official websites.
• Never share a code received by text message, a password or bank details with someone who contacts you.
• If you are impersonated, file a complaint and get help from cybermalveillance.gouv.fr.

One last point: appearing in this file does not prove that a person is an RN member. It remains to be seen whether the party will confirm, deny or file a complaint, and where these records really come from.