Handisport: nearly 200,000 members affected by a cyberattack

On 28 March 2026, the Fédération Française Handisport — the national governing body for disability sport in France — was hit by a data breach that exposed the personal records of 197,276 licensed members. A threat actor using the alias "HexDex" advertised the stolen database for sale on cybercrime forums such as BreachForums and Darkforum.

The breach was part of a wider wave of attacks against French sports federations in early 2026, in which the attacker gained access by compromising employee credentials for the administrative and club-management software used by the federations. The Handisport dump reportedly included 116,993 email addresses and 107,528 phone numbers alongside the member profiles.

The exposed data was especially sensitive because it combined identity, contact and health information:

• Civil identity: full name, gender, date and place of birth, nationality
• Contact details: email address, phone number, postal address
• Account data: license type, last active season, last login date
• Health data: type of disability and associated details

Because of the disability-related health data, observers warned of an elevated risk of targeted phishing, identity theft and exploitation or resale of medical information. The case fed into a broader investigation that led to the arrest in April 2026 of a young suspect in the Vendée region, linked to roughly a hundred reported intrusions against French organisations, including multiple sports federations.