French Basketball Federation (FFBB): 1.9 million licence holders exposed in a massive leak

On 17 April 2026, the French Basketball Federation (FFBB) — the national governing body for basketball in France — disclosed a large-scale data breach affecting the personal data of its licence holders and their families. A threat actor operating under the alias HexDex claimed to be selling a database of 1,926,409 members along with roughly 800,000 associated parents.

According to the FFBB, the breach stemmed from fraudulent access to a single user account, which was abused to operate the federation's licensee-management tool through its edition-management module and extract personal records. No software vulnerability or ransomware was reported; the incident was an account compromise leading to unauthorized data exfiltration. The data protection authority (CNIL) was notified in line with GDPR obligations.

The exposed information concerned up to 2 million licensees and around 900,000 legal representatives, including:

• Identity data: name, first name, date of birth
• Contact details: postal address, email address, telephone number
• Licence and club-membership information

The FFBB stated that no banking data, passwords, or health/sensitive data were compromised (though HexDex separately claimed to hold additional fields such as medical certificates). The federation warned that the primary risk for members and families is phishing, with scammers potentially impersonating the FFBB. French authorities identified and arrested the suspected perpetrator on 21 April 2026, four days after the leak was disclosed.