162,263 licence holders affected by claimed leak at FFSquash

On 7 January 2026, the French Squash Federation (FFSquash) — the national governing body for squash in France — was named in a data-leak claim alleging the theft of a database of 162,263 rows corresponding to its licence holders. The claim was published on a breach-tracking channel and lists the federation among the victims of a sustained wave of attacks against French sports federations during late 2025 and early 2026.

The FFSquash claim appeared in the same January 2026 cluster as the French Microlight (ULM) Federation (78,133 licence holders) and the Fédération Sportive et Gymnique du Travail (156,776). Across this campaign, attackers repeatedly targeted federations' member- and club-management portals through automated bot traffic, credential-stuffing and the compromise of administrator accounts, then offered the extracted member databases for sale or download on leak forums.

For comparable federation breaches in this wave, the exposed records typically included member personal data such as:

• First and last name
• Postal address
• Email address
• Telephone number
• Licence number

The scale and exact field set of the FFSquash extract were asserted by the party making the claim and have not been independently confirmed in detail. The broader campaign drew a regulatory response: France's data-protection authority, the CNIL, placed roughly thirty sports federations under scrutiny in 2026 to verify their GDPR compliance following the series of leaks. The status of FFSquash's own remediation and notification is not publicly documented.