Leak at French Football Federation (via Footclub)

On 27 November 2025, the French Football Federation (FFF) — the governing body for football in France, with more than two million licensees — disclosed a data breach affecting members registered through its club-management ecosystem. The federation said the intrusion was traced to a compromised user account rather than a software vulnerability.

Using the stolen credentials, the attackers gained administrative access to Footclubs, the management software clubs use to administer their licensed members, and exfiltrated personal data before the access was cut off. The FFF stressed that no banking data or account passwords were exposed.

The exposed data included:

• First name and last name
• Gender
• Date and place of birth
• Nationality
• Postal address
• Email address
• Phone number
• License number

After detecting the unauthorized access, the FFF disabled the compromised account and reset all user passwords. It filed a criminal complaint and notified France's national cybersecurity agency (ANSSI) and the data protection authority (CNIL), and committed to informing affected individuals directly. This was the third such incident to hit the federation in under two years, following earlier data thefts in March 2024 and February 2025.