French Election Cyberattacks: DDoS Waves Hit Political Parties Ahead of First Round

France's snap legislative elections (first round held Sunday, June 30, 2024, with a runoff scheduled for July 7) have made the country a fresh hotspot for election-linked cyber activity. Cloudflare's visibility of this traffic shows a pattern similar to earlier incidents in Ukraine and the Netherlands: political parties operating in the spotlight of a contentious vote come under targeted denial-of-service fire.

In the days around the first round, Cloudflare detected and mitigated DDoS attacks against three different French political parties, with each campaign taking a slightly different shape.

Attack Timelines: Three Parties, Three Tripwires

The first party suffered two separate attacks. The initial strike on June 23 peaked at 68,000 requests per second (rps), followed by a second, smaller assault on June 29 — the day before the election — that reached 20,000 rps. While these volumes are modest against Cloudflare's global infrastructure, they can overwhelm an unprotected digital presence.

The second party drew a more sustained campaign. Attackers targeted it on June 24, June 27, and June 29. The most intense push occurred on June 27, spiking at 118,000 rps amid a day of frequent, recurring surges. That single day aggregated roughly 610 million total requests against the party's online services.

The third party was hit on the evening of June 29 local time, with further attempts blocked throughout election day. The most severe burst on June 30 landed between 10:00 and 23:00 UTC, hitting close to 40,000 rps at 19:00 UTC (21:00 local time). That day brought over 620 million total DDoS requests aimed at the target.

Traffic Patterns on Voting Day

Beyond the attack telemetry, the first round produced a noticeable, if modest, shift in overall internet traffic. Early on election day, traffic actually ran higher than the preceding week before dipping by as much as 3% at 11:30 local time (09:30 UTC) following the opening of polling stations. The trend reversed after 17:45 local time (15:45 UTC), with interest climbing into a peak around 20:00 local time when polls closed and initial projections emerged.

Cloudflare expects to publish an updated analysis following the second round of the election on July 7. As 2024 continues to pack a dense calendar of national votes, the company's radar tracking has also recently added context from other races, including last-minute voting in Iran on June 28 and the mobile internet shutdown in Mauritania after June 29's presidential unrest.