109,302 CMF members: data leak claimed

On 20 March 2026, the Confédération Musicale de France (CMF) — the national federation grouping amateur music ensembles, orchestras and music schools — was the subject of a claimed data breach when a threat actor using the pseudonym HexDex advertised a CMF database for sale on cybercrime forums.

The actor claimed the batch covered 109,302 individuals, including roughly 86,800 unique postal addresses, 81,400 phone numbers and 80,500 email addresses. Of particular concern, a large share of those affected are minors enrolled in musical activities such as orchestras and music schools, and the samples shared to substantiate the claim included sensitive pedagogical and family information.

The exposed data categories reportedly included:

• Full names and dates of birth (including those of minors)
• Postal addresses, email addresses and phone numbers
• Enrolment and activity / school information
• Sensitive notes, including pedagogical remarks and disability situations
• Family-related details

HexDex, a young French operator (born 2004), was linked to roughly a hundred exfiltrations targeting French institutions from late 2025 onward — including sports federations, the national education system, unions and other organisations — and was arrested in the Vendée region in early April 2026. The CMF leak was one entry in this broader campaign; the precise intrusion vector against the CMF was not publicly confirmed, and the status of any official response or regulatory notification remains unclear.