Leak at French Mountaineering and Climbing Federation

On 24 January 2025, the French Mountaineering and Climbing Federation (FFME) — the national governing body for climbing and mountain sports in France — disclosed that it had been the target of an act of "cyber-malice" that exposed the personal data of its licensed members.

The breach was part of a broader wave of incidents hitting French sports federations in early 2025. In the FFME's case, a threat actor using the handle "TheFrenchGuy" exploited the federation's own member platform: a registered member account could upload files of any type without backend filtering, and because the server interpreted PHP, an uploaded script was executed server-side, giving the attacker access to the underlying data. Publicly, the FFME characterized the incident as the fraudulent use of a legitimate user account granting unauthorized access to a limited set of personal data, and stated it found no evidence of deeper infrastructure intrusion, compromised authentication or leaked passwords.

The leaked dataset, catalogued by the bonjourlafuite tracker, comprised 808,881 accounts. Exposed fields included:

• Last name and first name
• Postal address
• Email address
• Member identifier
• Date of birth
• Phone number

No passwords or banking data were reported as compromised. The FFME applied immediate containment measures, opened an investigation, notified affected members and warned of a heightened risk of targeted phishing and identity-theft attempts in the federation's name.