1,200,000 people exposed in data leak at FFVolley

On 23 January 2026, the French Volleyball Federation (FFVolley) — the national governing body for volleyball in France — was publicly reported to have suffered a major compromise of its membership database, affecting roughly 1.2 million licensees. The intrusion itself is believed to date back to December 2025, with the attackers retaining access into early January 2026 and continuing to extract documents before the leak surfaced.

The breach was attributed to a threat actor operating under the name Dumpsec, who advertised around 23 GB of stolen data for sale. Unusually for a sports federation, the trove went well beyond contact details: it included scans of official identity documents, some belonging to minors. FFVolley publicly acknowledged the "acte de cybermalveillance" but characterised the exposure only as "certaines données personnelles," a framing criticised by researchers given the sensitivity of the documents on its servers.

Data categories reported as exposed include:

• Full names, contact details and postal/location data
• National identity cards (CNI) and passports
• Birth certificates, including those of minors
• Personal photographs
• Signed administrative documents

The incident is part of a broader wave of attacks against French national sports federations during the same period. FFVolley confirmed the compromise and notified affected members; as the stolen data has been put up for sale, the situation remained ongoing at the time of reporting.