The leak, which involved posting campaign documents like emails and accounting records to message boards, occurred late on Friday, hours before a legal prohibition on campaign communications went into effect across France. In response, Mr. Macron’s team said the hackers had included fake information alongside authentic material “to sow doubt.”
“Intervening in the final hour of the official campaign, this operation is clearly a matter of democratic destabilization, as was seen in the United States during the last presidential campaign,” Mr. Macron’s campaign said in a statement late Friday, minutes before the communications prohibition went into effect.
By Saturday, a trail of digital crumbs appeared to tie the attack on Mr. Macron’s campaign to Russian hackers. Forensics specialists found that one of the leaked Excel documents from Mr. Macron’s campaign had been modified on a Russian version of Excel, and edited on Russian-language computers.
One document had last been modified by a Russian user named Roshka Georgiy Petrovich. Mr. Petrovich, 32, an employee of the Moscow-based Eureka CJSC, a Russian technology company, did not immediately return emails requesting comment. Eureka CJSC’s clients include several Russian government agencies.
United States intelligence officials say that Russian government agencies regularly outsource political cyberattacks to Russian cybercriminals and top computer engineers. Security experts note that the digital crumbs could be the sloppy work of a Russian engineer, or studiously left as a so-called false flag used by hackers looking to mask their true identities and whereabouts.
Within hours after the hacked documents were made public, the hashtag #MacronLeaks began trending worldwide, aided by far-right activists in the United States who have been trying to sway the vote in favor of Ms. Le…