728,732 members - claimed data leak at French Motor Sport Federation

On 24 February 2026, the French Motor Sport Federation (FFSA) — the governing body for motorsport (karting, rally, circuit racing) in France — was named in a claimed data leak in which a threat actor advertised a database of its members for sale on cybercrime forums such as BreachForums.

The incident is part of a broader wave of intrusions against French sports federations. Investigators tied the compromise to a vulnerability at a third-party IT provider that managed licensing and administrative systems for multiple federations, allowing an attacker (operating under the alias "TheFrenchGuy") to extract member databases. The FFSA detected unauthorised access to data on its website www.ffsa.org, took the site offline, and launched a technical investigation.

The data exposed reportedly included:

• Full names (first and last)
• Dates of birth
• Postal addresses
• Email addresses
• Phone numbers
• Licence and federation details

No passwords, banking data or medical information were reported as compromised. The seller claimed a database of 728,732 members, though the precise scale is disputed across reporting, with figures ranging from roughly 356,000 licensees to as high as 1.7 million members.

The FFSA publicly confirmed the breach on 16 February 2026, apologised to members, notified the French data-protection authority (CNIL), filed a criminal complaint, and warned licensees of a heightened risk of targeted phishing using their genuine contact details. Affected members were directed to dpo@ffsa.org.