599,797 licence holders: claimed data leak at FSGT

On 8 January 2026, the Fédération Sportive et Gymnique du Travail (FSGT) — a French multisport federation founded in 1934 that organises grassroots and workers' sport across thousands of clubs — was reported as the target of a claimed data leak affecting its licence holders. The claim referenced a database of roughly 600,000 accounts (599,797 records), making it one of the larger entries in the wave of breaches that struck French sports federations over this period.

The incident fits the pattern documented across dozens of French federations in late 2025 and early 2026: attackers gained access to licensee-management systems, typically through compromised credentials or mutualised third-party club-management software with weak security (no multi-factor authentication, reused or weak passwords), and exfiltrated the membership databases.

For affected licence holders, the exposed information is consistent with the licensee records held by these federations:

• Full name and sex
• Date of birth
• Postal address
• Email address and phone number
• Licence / membership number

The leak forms part of a broader series that prompted the French data-protection authority (CNIL) to make sports federations a priority for inspections in 2026, citing systemic weaknesses in how membership data is secured. The exact scope and FSGT's official response were not confirmed in public reporting at the time, and the figures stem from the attacker's claim; the incident is best treated as a claimed but unconfirmed leak.