Leak at French Basketball Federation

On 3 May 2026, the French Basketball Federation (FFBB) — France's national governing body for basketball — publicly disclosed a major data breach affecting its licensee database. The federation detected the unauthorized access on the evening of Friday 17 April 2026.

The attacker did not exploit a software vulnerability but instead gained fraudulent access to a legitimate user account, which was used to misuse the federation's licensee-management tool (via its edition-management module) and extract personal data at scale. The exfiltrated files were briefly published on dark-web forums before being removed.

The breach affected up to roughly 2 million licensees and around 900,000 legal representatives (parents/guardians of minor members). The exposed data was limited to the following categories:

• First name and last name
• Date of birth
• Postal address
• Email address
• Phone number
• License number and club affiliation

The FFBB stated that no banking data, passwords, or health/sensitive data were compromised. The federation warned licensees and their families of an elevated phishing risk, as fraudsters could impersonate the FFBB to extract further information. The main suspect — a young man operating under a pseudonym and linked to intrusions against several other French sports federations — was identified and arrested on 21 April 2026. The FFBB reported the incident to the CNIL (data protection authority) and ANSSI (national cybersecurity agency).