393,374 members affected in the data leak at FFCK

On 7 January 2026, the French Canoe-Kayak Federation (FFCK) — the national governing body for canoeing, kayaking and paddle sports in France — was hit by a confirmed data leak exposing the personal records of 393,374 members. The stolen database spanned 31 years of membership history, reaching back to 1995, and was published on the cybercrime marketplace BreachForums.

The breach was part of a broader wave of attacks that compromised more than 30 French sports federations in early 2026. Rather than breaching central databases directly, attackers typically targeted the shared club- and license-management platforms used across multiple federations; access was often possible because employee accounts were inadequately protected, with two-factor authentication not enabled.

The exposed data included:

• Members' names and first names
• 392,892 postal addresses
• 212,342 phone numbers
• 158,434 unique email addresses
• License and membership details

The volume and quality of the leaked records — full identity and contact information accumulated over three decades — create a significant risk of phishing, identity theft and targeted fraud against affected members. The incident was reported in the press and acknowledged in connection with the wider federation breach campaign; the stolen data is no longer accessible from FFCK's live systems, but copies remain in circulation on cybercrime forums.