Hacker uploads data from political movement

A hacker known as ChimeraZ has uploaded over one million lines of data extracted from the digital records of La France insoumise's door-to-door visits to the PwnForums forum. The files, reportedly a partial database from the movement's website lafranceinsoumise.fr, amount to 544 MB and contain 1,270,096 lines.

Data includes addresses and campaign details

The data includes public addresses linked to GPS coordinates and specific campaigns, such as "Municipal Election 2026" in Bonneuil-sur-Marne, in the Val-de-Marne. These addresses are identified by the interoperability key of the National Address Base, which the State publishes as open data.

Most data comes from one file

Approximately 1.1 million lines, or the majority of the archive, are grouped in a single file. According to Cyberattaque.org, which had access to the door-to-door files, the data does not pertain to 1.2 million members or sympathizers but rather to the militants who conducted the visits.

Files detail militant activities

The militants are listed in the second file, with their names or pseudonyms. About 200 of them recorded 12,959 visits, with details such as the date, the accessibility of the building, 158,040 doors knocked on, and 54,838 doors opened. The most recent visits date back to this week, and 2,462 relate to the 2027 presidential campaign.

Tools used for door-to-door visits revealed

La France insoumise organizes its militants on Action populaire, and Cyberattaque.org has found in the files the structure of the two door-to-door tools of the platform, TokTok and Canvass. The movement added in 2024 to Action populaire a targeting tool, designed to "target militant actions using the electoral analysis of a geographic area," according to its activity report.

Personal information of militants exposed

ChimeraZ included 11,430 local group events, scheduled between 2017 and 2027, with the coordinates of their organizers. After deduplication, Cyberattaque.org counted approximately 5,000 phone numbers and 911 email addresses, although part of this information is visible to everyone on the event pages of Action populaire.

Sensitive data under GDPR

In total, approximately 5,900 people are identifiable by a name, an email address, or a phone number, estimates Fuites Infos. The militants named in these files can be linked to La France insoumise, and therefore to a political opinion. For the CNIL, this information is sensitive under Article 9 of the GDPR, as it concerns political opinions "real or presumed."

Residents not named in the files

The residents of the visited addresses are spared, as no person met behind the doors is named in the files. If you have organized an event on Action populaire or knocked on doors for the movement, be wary of messages sent in the name of a neighboring group or the leadership, even when the sender cites a real meeting or your door-to-door area.

Security advice for users

Open Action populaire from the application or the site, never from a link received by SMS or email, and report any suspicious attempt to the public platform for victims' assistance. In May, another hacker had uploaded an Action populaire database with 120,000 email addresses, and the movement then filed a complaint with the CNIL and the ANSSI.

Uncertainty about data breach

Until La France insoumise explains how ChimeraZ obtained records from a few days ago, its militants cannot know if the visits they record on their next outing will be secure.