Hack of France's National Rally exposes members' political affiliation

On October 31, at 1:41 a.m., a post appeared on a hacker forum. Its author, who signs as “shin0bi,” claims to hold 432,597 records linked to the Rassemblement national (RN, France's National Rally party) and published a first batch of 150,000. Four days later, on Wednesday, November 4, the party broke its silence. In a statement, it acknowledged that “an IT tool used to manage memberships” was targeted by an attack and that information about some of its members was disclosed without authorization.

The RN does not say how many people are affected. It says the incident was “quickly contained,” that the fraudulent access was cut off and that its entire member file was not affected. The party says it notified the CNIL (the French data protection authority) and filed a complaint with the Paris prosecutor's office.

What the party admits to losing

According to the statement, as reported by Clubic, Tom's Guide and Cyberattaque.org, the exposed data is as follows: first and last name, email and postal addresses, phone number, occupation, year of joining, amount of the membership fee and local federation. The text mentions neither bank details nor passwords.

The RN also does not specify how the intruder got in, when the attack was discovered, or who is behind it. As Cyberattaque.org points out, these gaps make it impossible to know everything the attacker may have accessed.

Does the published file really come from the RN?

The question remains open. The party has confirmed neither that the archive posted on October 31 comes from the compromised tool, nor the figure claimed by the hacker. The published analyses also call for caution. According to FrenchBreaches, which says it examined the archive and alerted the RN before its statement, and according to Cyberattaque.org, the 150,000 lines contain 28,420 exact duplicates. That leaves only 121,580 distinct lines, and a line does not necessarily correspond to one person. Cyberattaque.org also notes inconsistencies, such as a postal code in the Rhône département paired with a Toulouse canton.

Clubic points out another discrepancy: the leaked file contains dates of birth, which are absent from the list of data the party acknowledges. Some of the records could therefore come from the attack, and others from elsewhere.

More sensitive than a simple address

Appearing in a party's file reveals a political opinion. The EU General Data Protection Regulation (GDPR) classifies this information as sensitive data, protected by its Article 9. The RN itself warns against malicious use of its members' political affiliation, according to Clubic.

The party is not the only one affected. In October, the Communist Party confirmed the leak of its member file. Meanwhile, Renaissance and La France insoumise deny any intrusion after the release of door-to-door canvassing files attributed to them. Those claims bear the signature of another hacker, ChimeraZ. In July, the RN's website had already been hacked. The party said at the time that member data was not affected, and nothing at this stage links the two cases.

Members: what to do

No password is needed to trap someone whose name, phone number and political commitment are known. The RN advises its members to be wary of unusual calls and messages, and warns against fraudulent solicitations and phishing.

• Do not give any bank details to a caller who claims to be the party or a federation and asks for a membership fee, a donation or a “regularization.”
• If in doubt, hang up and call your federation back on a number you already know.
• Be wary of messages that cite your occupation or year of joining to seem credible: these details are part of the exposed data.
• For any question about your data, the party refers members to its data protection officer.

It remains to be seen how many members are actually affected: neither the party nor the CNIL has given a figure. A few months before the presidential election, the outcome of the complaint may reveal who is behind “shin0bi.”