Leak at French Cycling Federation

On 10 December 2025, the Fédération Française de Cyclisme (FFC) — France's national governing body for cycling — disclosed that it had detected an unauthorized intrusion into its information system. The federation said the breach occurred during the night of 8–10 December and was identified on 10 December.

According to reporting, the attackers gained access through compromised user credentials harvested by infostealer malware on members' workstations, exploited via the federation's online "Espace Club" / licensing platform. The absence of multi-factor authentication facilitated the unauthorized access. The FFC filed a complaint and notified the French authorities.

Personal data captured during licence registration was potentially accessed:

• First and last name
• Date of birth and nationality
• Postal address
• Email address
• Telephone number

The FFC stated that its document database and the identity documents stored on the Espace FFC were not affected. However, the cybercriminal group Dumpsec publicly claimed the leak was far larger and said it held samples of thousands of identity documents (national IDs, passports) — a claim the federation disputes and which has not been independently verified. A significant share of those affected are minors holding youth licences. The FFC reset all user passwords, suspended some platform functions, and notified ANSSI and the CNIL while announcing the rollout of multi-factor authentication. The incident formed part of a wave of late-2025 breaches affecting French sports federations.