2,978,518 members - claimed data leak at French Gymnastics Federation

On 26 February 2026, the French Gymnastics Federation (Fédération Française de Gymnastique, FFGym) — the national governing body for gymnastics in France — was reported to have suffered a large-scale breach of its membership database, subsequently confirmed by the federation in early March 2026.

The intrusion was traced to a club account compromised through a phishing attack on the FFGym Licence platform, the federation's online licensing system. Using the stolen credentials, attackers were able to extract personal data covering roughly 2.9 million current and former licence holders, with records reaching back to 2004 — some 22 years of membership history.

The exposed data varied by membership recency. For active members or those licensed within the previous four years, the compromised fields included:

• First and last name
• Date of birth
• Sex
• Postal address
• Email address
• Phone number
• Licence number

For older records, exposure was limited to name, date of birth and licence number. The federation stated that no sensitive data — in particular banking or medical information — was affected.

In response, the FFGym suspended the licensing platform, opened an internal investigation with cybersecurity specialists, notified the French regulator (CNIL) and national cybersecurity agency (ANSSI), forced password resets, and announced plans to deploy two-factor authentication. The incident formed part of a wider wave of attacks that hit around twenty French sports federations during the same period.