2.4 million licence holders - data leak at French Judo Federation

On 12 February 2026, the French Judo Federation (Fédération Française de Judo, "France Judo") — the national governing body for judo, jujitsu, kendo and associated disciplines — confirmed that it had fallen victim to a cyberattack against its federal extranet, the online platform clubs and members use to manage licences.

The cybercriminal group RavenSec had obtained and put up for sale around 2.4 million lines of data drawn from the federation's membership database, spanning roughly 23 years of records. The trove exposed personal data on 533,730 licence holders, and analysts warned that the combination of identity documents and health records created a severe identity-theft risk. The stolen data was reported to be circulating on dark-web channels.

Exposed data reportedly included:

• Names and postal addresses
• About one million photographs of members, including images of minors
• 948 national identity cards (CNI)
• Social security numbers
• Medical and accident-declaration health data

France Judo acknowledged the incident in an internal communication to its clubs and members, framing it as an act of cyber-malice against the federal extranet. The breach formed part of a wider wave of attacks on French sports federations in late 2025 and early 2026 that prompted the CNIL to announce regulatory scrutiny of the sector. As of disclosure the leaked data remained in circulation and the situation was ongoing.