The National Rally (Rassemblement national, RN) data breach is a cyberattack that the French party confirmed on November 4, 2026. It targeted an IT tool used to manage memberships and led to the disclosure of part of some members’ data. A hacker using the alias “shin0bi” has claimed a database of 432,597 lines since October 31, according to FrenchBreaches, a figure the RN has not confirmed.
The party has given no number of people affected. Here is what we know, what is disputed and what members can do.
What do we know about the National Rally data breach?
We know the RN acknowledges a cyberattack, describes an “unauthorized disclosure” of part of some members’ data and says the incident was quickly contained. According to Génération NT, the party states that the full membership file is not affected. It has notified the French data protection authority (CNIL) and filed a complaint with the Paris prosecutor’s office.
According to Cyberattaque.org, the RN did not say how many people were affected or when the intrusion was discovered. The party also warned its members against phishing and the misuse of their political affiliation, per Génération NT.
National Rally data breach: which data is involved?
According to the party’s communication as reported by FrenchBreaches, the data covers surnames, first names, postal addresses, emails and phone numbers, as well as professions. It adds membership information: year, dues amount and affiliated federation. Cyberattaque.org notes that the party did not mention bank details or passwords. FrenchBreaches says nothing confirms the presence of identity documents or social security numbers.
Figures that are still disputed
The hacker “shin0bi” claims 432,597 lines and published an archive of 150,000 lines as proof. FrenchBreaches found 28,420 duplicates in it, leaving 121,580 distinct lines, which do not necessarily match as many people. The site also notes inconsistencies: some records pair addresses from other departments with Haute-Garonne cantons, and some list several cantons. The authenticity of the whole is not established, and the file could combine several sources or have been partly altered.
- Claim date: October 31 according to FrenchBreaches and Cyberattaque.org, “a few days” before the statement according to Tom’s Guide, which gives no date.
- Incident date: the FrenchBreaches record shows November 6, while the RN statement is dated November 4.
- Alert headline and body: the FrenchBreaches page address mentions 121,000 members, while its text speaks of 432,597 claimed lines.
- Number of members affected: no independent source knows it, and the RN has not given it.
An incident within a series of attacks on parties
Cyberattaque.org recalls that several parties have been targeted in recent weeks: La France insoumise and Renaissance on October 24, the PCF on October 27, the Parti radical de gauche on October 30 and Les Écologistes on October 31. These cases should not be added together and do not all rest on the same claims. According to Tom’s Guide, an actor named ChimeraZ had claimed the attacks on the PCF, LFI and Renaissance, while the RN is targeted by a different alias, “shin0bi”.
Cyberattaque.org also notes that the RN’s website had already been attacked in July 2026, with WordPress leaks claimed, and that the party then stated members’ personal data was not exposed. The site finds nothing linking the two incidents. On ChimeraZ, we have already covered another case in our article on the French Shooting Federation breach.
Why political affiliation is a particular risk
Party membership is sensitive data under the GDPR because it reveals political opinions. Its disclosure exposes members to pressure, harassment or scam campaigns that build on their involvement. A message that cites your dues, your federation or your profession looks more credible, as our guide to phishing explains.
Our analysis: caution on numbers, vigilance on messages
This section is our analysis. The figures should be handled with care: 432,597 is a claim, 121,580 is the result of deduplicating a sample, and neither says how many people are affected. What is established is the disclosure confirmed by the party itself, which is enough to justify vigilance. The geographic inconsistencies noted by FrenchBreaches remain unexplained, and only a detailed response from the party or the CNIL could settle them.
What to do if you are a member
Assume your data may have been exposed. The RN warned its members of possible phishing campaigns in the coming days, according to Tom’s Guide. Here are the steps to take:
- Be wary of emails, texts and calls that mention your membership, your dues or your federation, and do not open links without checking the sender.
- Never share an SMS code, a password or bank details with someone who contacts you unprompted.
- Change the password of your member account and of any service where you used it, with two-factor authentication if possible.
- Contact the data protection officer whose details the party published to exercise your rights, and check with the CNIL if needed.
- In case of threats or harassment, keep the evidence and file a complaint.
Frequently asked questions about the National Rally data breach
Yes. On November 4, 2026, the party confirmed a cyberattack on a membership management tool, with unauthorized disclosure of some members’ data. It has not given the number of people affected.
Surnames, first names, addresses, emails, phone numbers and professions, plus membership year, dues amount and federation. Nothing confirms the presence of bank details or passwords.
Unknown. The hacker claims 432,597 lines, and a 150,000-line sample yields 121,580 distinct lines, without necessarily matching as many people.
Be wary of messages citing your membership, share no code or password, change your password and contact the party’s data protection officer if in doubt.
