French Savate Federation: nearly 680,000 licence holders exposed over 49 years

On 30 March 2026, the Fédération Française de Savate — the national governing body for savate (French kickboxing) and related disciplines — was hit by a data breach after an attacker exfiltrated and put up for sale a database of roughly 679,000 licence-holder profiles. The records reportedly span 49 years, from 1977 to 2026, meaning much of the historical data should have been deleted years earlier under data-retention rules.

The threat actor, operating under the alias HexDex, advertised the stolen database for sale and circulated sample records as proof. HexDex was later identified as a 21-year-old man who was arrested in the Vendée region on 20 April 2026; investigators linked him to a wider campaign against numerous French sports federations, including sailing, athletics, motorsport, gymnastics, skiing, rugby league, aikido, university sport, mountaineering/climbing and disabled sport.

The exposed data reportedly included:

• Identity details (names)
• Contact information (email, phone, postal address)
• Sports-licensing data, including club and discipline affiliations

Given the breadth and 49-year depth of the dataset, the exposure carries a particularly high risk of targeted phishing, identity theft and long-term misuse of personal data. As of the disclosure date the data was being offered for sale, and no remediation statement from the federation had been published.