561,502 licence holders affected by data leak at FFME

On 8 January 2026, the French Federation of Mountaineering and Climbing (FFME) — the national governing body for climbing and mountain sports — disclosed a security incident affecting its membership-management platform. The federation attributed the breach to the fraudulent use of a legitimate user account, which allowed an attacker to gain illegitimate access to a limited portion of the platform's personal data.

According to the FFME, the exposed information was confined to contact details. No banking data or passwords were affected, and the federation said its investigation found no evidence of an intrusion into the wider IT infrastructure or of any compromise of the platform's authentication mechanisms. The breach is tracked at 561,502 affected records.

The categories of data exposed include:

• First and last name
• Date of birth
• Contact details (address and other coordinates)
• Licence type
• Affiliated club / structure

The FFME said the unauthorised access was quickly detected and blocked, and that it would write individually to the people affected. It urged members to be vigilant against phishing attempts and directed concerns to its data protection officer (dpo@ffme.fr). The incident formed part of a wider wave of attacks reported against numerous French sports federations and the Sports Ministry over the preceding months. This is a separate event from the earlier, larger 2025 breach tied to a shared licensing-platform provider.