Tipped off by the state, France's Communist Party confirms its member file leaked

The party did not discover the leak itself. On Friday, October 23, the ANSSI (France's national cybersecurity agency) warned the French Communist Party (PCF) that its file of members and supporters was circulating. The same day, the party issued a statement confirming the incident.

According to the specialist site FrenchBreaches, cited by franceinfo, one person claims to hold a file covering nearly 190,000 members. The same site mentions names, first names, postal addresses, phone numbers and email addresses. The PCF has confirmed neither the figure nor the list of data at this stage.

What the party acknowledges, and what it does not yet know

The PCF says it “immediately began securing its systems,” according to franceinfo. Investigations must establish the origin of the leak, its scale and the exact nature of the stolen data. The party says the file contains no banking details or payment methods, and that “no banking data has been compromised.”

The CNIL (the French data protection authority) has been notified, as the law requires. The party says it will file a complaint, apologizes and promises to inform those affected by email. Franceinfo does not name the person behind the claim.

Why a political file is more sensitive than a customer database

Appearing in a party's file reveals a political opinion. The General Data Protection Regulation (GDPR) classes this information as so-called sensitive data, which benefits from stronger protection. The PCF itself describes the data as “highly sensitive.”

France has already seen similar cases: in October, hackers claimed to have stolen data from the Les Républicains website, which the party denied, as we reported. In Germany, the AfD confirmed the hacking of the provider hosting its mailboxes.

What to do if you are a member or supporter

According to the party, the file contains no banking details, so the main risk is phishing: fraudulent messages that rely on your tie to the party to look credible. The PCF also urges vigilance against suspicious emails, calls and text messages.

• Be wary of messages that cite your membership to ask for dues, a donation or an “update” of your information: check with your local federation through a channel you know.
• Do not click links received by text message, and never share a code received by phone.
• Expect targeted solicitations by mail or phone.
• If in doubt, you can report a fraudulent text message to 33700 and find help at cybermalveillance.gouv.fr.

The questions that remain open

How did the file get out: a server hack, a hijacked access account, a service provider? How many people are really in it, and since when? The party promises to get back to its members. The real figure and the origin of the leak will show whether the incident is limited to the PCF or affects a tool shared by other organizations.