Leak at FFCK and Paddle Sports

On 19 February 2026, the Fédération Française de Canoë-Kayak et Sports de Pagaie (FFCK) — France's national canoe, kayak and paddle-sports federation — was hit by a large data breach when a member database was extracted and put up for sale on a cybercrime forum. The leaked file spanned decades of licensing records, covering generations of paddlers rather than only current members.

The breach reportedly affected around 393,374 people. The exposed data was extensive, combining identity details with full contact information and federation-specific fields:

• Last name, first name, gender and date of birth
• Postal addresses (reportedly hundreds of thousands of records)
• Phone numbers and email addresses
• Club name, departmental and regional committee names and codes
• Licence type and paddle-skill colour (pagaie couleur)

The incident is part of a broader wave of attacks against French sports federations, several of which had member databases stolen and traded on BreachForums; some of those earlier breaches were traced to a flaw at a shared IT service provider. Whether the FFCK leak stems from the same supply-chain weakness or from a direct compromise was not conclusively established in public reporting. With names, dates of birth and home addresses exposed, the main risk to affected members is identity theft and targeted phishing. The exact attack vector and the federation's full response remain unclear.