Leak at French Gymnastics Federation

On 27 February 2026, the French Gymnastics Federation (Fédération Française de Gymnastique, FFGym) — the national governing body for gymnastics in France — disclosed a data breach affecting roughly 2.9 million current and former licensees registered since 2004, some 22 years of records.

The attacker gained access through a club account on the federation's licence-management tool, FFGym Licence, after the account's credentials were stolen in a phishing attack. Using the compromised account, the intruder was able to query an internal database and exfiltrate licensee records. The incident is part of a broader 2026 wave of cyberattacks against French sports federations; a 20-year-old suspect was later arrested in April 2026 in connection with breaches across several federations.

Exposed data categories included:

• Last name, first name
• Date of birth
• Gender
• Postal address
• Email address
• Phone number
• Licence number

For active licensees (or those active within the previous four years), the full set above was exposed; for older records, only last name, first name, date of birth and licence number were affected. The federation stated that no sensitive data — banking or medical information — was compromised.

In response, FFGym suspended the FFGym Licence tool, forced password resets, opened a cybersecurity investigation, filed reports with France's data-protection authority (CNIL) and cybersecurity agency (ANSSI), and announced plans to roll out two-factor authentication.