France 2017 Presidential Election
April 23, 2017 – May 7, 2017
A foreign hack-and-leak operation dumped Emmanuel Macron's campaign emails online 44 hours before the run-off, but it did not alter the outcome: Macron won 66.1% to 33.9%. Hand-counted paper ballots, a mandatory pre-vote media blackout, and obvious forgeries in the leak blunted the operation — a textbook case of interference that is not falsification.
Official results
First round, 23 April 2017 (turnout 77.77%)
- Emmanuel Macron (En Marche!)24%8,657,326
- Marine Le Pen (Front National)21.3%7,679,493
- François Fillon (Les Républicains)20%7,213,797
- Jean-Luc Mélenchon (La France insoumise)19.6%7,060,885
- Benoît Hamon (Parti socialiste)6.4%2,291,565
Run-off, 7 May 2017
- Emmanuel Macron (En Marche!)66.1%20,743,128
- Marine Le Pen (Front National)33.9%10,638,475
The Integrity Ledger
What the evidence establishes, and what it does not — side by side, each finding sourced and tiered.
What is established
- Information operationsConfirmed
A hack-and-leak dump of roughly nine gigabytes of stolen En Marche emails appeared online on 5 May 2017, hours before the mandatory pre-vote media blackout. Forged documents were mixed in with genuine ones, and the material was amplified as #MacronLeaks to about half a million tweets within 24 hours by bot networks and US alt-right accounts.
- Foreign interferenceCorroborated
The campaign was targeted by spear-phishing in the weeks before the leak. Trend Micro linked the phishing infrastructure to APT28 (GRU) in April 2017, and in October 2020 the United States indicted six officers of GRU Unit 74455 (Sandworm) for the 2017 hack-and-leak against En Marche.
What is not established
- Result falsificationDebunked
There is no evidence the operation changed the result. Macron won decisively (66.1% to 33.9%) on hand-counted paper ballots; the leak's timing against the media blackout, the electoral commission's warning not to republish it, and the obvious forgeries in the dump all limited its effect.
- Foreign interferenceContested
Attribution was not established in real time. France's cyber-defence agency ANSSI found no APT28 fingerprints in the leak, and its director said the attack was 'so generic and simple that it could have been practically anyone.' A formal state attribution came later and from abroad — the 2020 US indictment — not from France in 2017.
Sources:1
Process assessment
The vote itself was administered normally. The Constitutional Council reviewed the count and annulled 16,467 ballots across 38 of 69,242 polling stations (0.05% of votes cast) — routine local irregularities, with no finding that the tally was compromised.