11 million records and documents - claimed leak at French Athletics Federation

On 23 February 2026, the French Athletics Federation (FFA) — the national governing body for athletics in France — was confirmed as the victim of a major data breach after a threat actor put a stolen database of its members up for sale. The federation publicly disclosed the cyberattack against its membership-management software on 21 February.

The attacker had reportedly maintained access to the FFA's systems for more than two months, reaching the application's administration panel and gaining SQL access, which allowed the extraction of roughly 11.4 million records covering licensed athletes, officials and coaches. The dataset advertised for sale included around 5 million passwords, of which an estimated 3 million were stored in plain text. The criminal demanded a ransom of about 5,000 dollars; there is no indication the FFA paid.

Exposed data categories included:

• First and last name, sex
• Email and postal addresses
• Date and place of birth
• Telephone number
• Account passwords (millions in plain text)
• Licence-related data

The FFA notified France's data-protection authority (CNIL) and said it would file a criminal complaint, while warning members to stay vigilant against fraud and phishing attempts. The federation declared the incident closed and said it had strengthened its data-protection measures. The breach formed part of a wider 2026 wave of attacks on French sports federations; the hacker behind it, known online as "HexDex," was later arrested and placed under investigation.