A Closer Look at the Online Fallout from France’s 2024 Runoff

The second round of the 2024 French legislative election on July 7 produced a different outcome than the first round on June 30, with the New Popular Front (NPF) securing the most seats, ahead of President Macron’s Ensemble and the National Rally. Alongside the political shifts, Cloudflare’s data shows a distinct pattern of cyber attacks targeting political parties and a significant drop in national Internet traffic as polls closed and initial results were announced.

Renewed DDoS Barrage on Political Parties

The weeks surrounding the French elections saw a series of distributed denial-of-service (DDoS) attacks aimed at political party websites, continuing a trend observed during recent elections in the Netherlands and the UK. While such attacks are not always election-related, their frequency during these periods is notable.

Cloudflare intercepted several significant attacks. One party was targeted on June 29, the evening before the first round, with attacks continuing throughout election day from 10:00 to 23:00 UTC. The strongest of these peaked at nearly 40,000 requests per second (rps) at 19:00 UTC. By the end of that day, Cloudflare had recorded a total of 620 million DDoS requests.

The largest attack mitigated by Cloudflare occurred on July 3. Lasting four minutes and peaking at 151,000 rps, it was the second-largest attack observed against political parties recently, comparable in intensity to an attack on a UK political party. Another party, which had been hit previously on June 24, 27, and 29, was again targeted on the runoff day itself, July 7. Attacks on that day began at 09:55 UTC and continued sporadically until 23:18 UTC, with a peak of 96,000 rps at 11:40 UTC.

While these rates may be manageable for a major CDN, they can be devastating for organizations without such protection. Beyond overwhelming systems, DDoS attacks often serve as a distraction for IT teams while attackers probe for other vulnerabilities.

Traffic Dip at the 20:00 Announcement

The runoff election day saw a different Internet traffic pattern than the first round. Morning traffic was stable, but a significant decrease was observed in the afternoon, particularly after 17:30 local time. As polling stations in major cities closed at 20:00, TV media began broadcasting initial results, and French Internet traffic dropped 16% compared to the previous week.

This dip was not uniform across the country. The most pronounced decreases were in the eastern regions of Bourgogne-Franche-Comté and Grand Est, which both saw traffic fall by 19%. In the Île-de-France region around Paris, the drop was smaller at 10%, while in the southern region of Provence-Alpes-Côte d’Azur, it was less pronounced still at 7%.

More Mobile Usage on Election Days

The two election days also saw a notable increase in the share of traffic coming from mobile devices. While Sunday mobile traffic share over the past month typically sat between 53% and 54%, it jumped to 57% on June 30 and rose further to 58% on July 7. The increase was especially pronounced during daytime hours of the voting period.

News and Social Media Traffic Peaks

DNS data from Cloudflare’s 1.1.1.1 resolver reveals a strong interest in news during the elections. For French news domains, DNS traffic on June 30 was 250% higher at 20:00 local time than the previous week. On July 7, the surge was 6% lower than that peak.

For French TV domains, the trend reversed during the runoff. At 20:00 local time on July 7, DNS traffic was 391% higher than the Sunday before the election rounds, compared to a 274% increase on the first round day. This represented a 31% jump over the first-round traffic.

Microblogging social media also saw increased activity on both election days. Traffic at 20:00 local time was 38% higher on June 30 compared to the previous Sunday, but only 32% higher on July 7—a 4% decrease from the first-round peak.

Tracking Elections Throughout 2024

Cloudflare’s data shows that the decisive runoff election attracted more attention than the first round, with a clear dip in Internet usage when TV stations announced their predictions. Continuous updates on these trends, including traffic data from elections in Iran and Mauritania, are available via the 2024 Elections Insights report on Cloudflare Radar.