Leak at French Archery Federation (via ITAC)

On 20 January 2025, the French Archery Federation (Fédération Française de Tir à l'Arc, FFTA) — the national governing body for the sport of archery in France — disclosed a personal-data breach that had occurred in early January. The federation traced the incident not to its own systems but to a security flaw at the external provider that runs its online "license and officials" spaces — an extranet platform shared by dozens of French sports federations.

Because the same provider served many federations, the breach extended well beyond archery: the Fédération Française de la Montagne et de l'Escalade (climbing) reported a comparable compromise affecting around 120,000 licensees. A threat actor operating under the handle "TheFrenchGuy" advertised more than 600,000 records attributed to the FFTA for sale online; the dataset extracted by the ITAC processor for this record totals 625,434 accounts, a figure that likely reflects the full provider database rather than archery licensees alone.

Exposed data categories included:

• Last name, first name and gender
• Date of birth
• Postal address
• Phone number
• Email address
• Profile photo

Account passwords were reportedly stored encrypted and were not exposed in usable form. In response, the FFTA and its provider closed the exploited vulnerability and neutralised the malicious file, the federation notified France's data-protection authority (CNIL), filed a criminal complaint, and an external security audit was launched. The provider stated it had implemented reinforced technical security measures following the incident.