Leak at the French Ministry of Sports

On 19 December 2025, the French Ministry of Sports, Youth and Associative Life — the government department running the Pass'Sport youth-activity subsidy — confirmed that data had been exfiltrated from one of its information systems, affecting roughly 3.5 million households. A file of around 22 million lines was offered on a criminal forum, where a threat actor presented it as retaliation against the French state.

The exposed records came from the Pass'Sport program rather than from the CAF family-allowance fund, which officials explicitly ruled out as the source despite early rumors. Analysts pointed to an insecure-access flaw on the partner portal aggregating beneficiary data as the likely entry point. The leaked sample combined identity, contact and benefit-administration fields, including highly sensitive national identifiers.

Data categories reported as exposed:

• First and last name, date of birth, gender
• Email address, postal address, phone number
• Category of aid received and organization code
• Social security number, INE (student) number, CAF number
• Pass'Sport voucher code

The ministry said it had mobilized technical teams to scope the incident and halt further leakage, filed a complaint with the authorities, and notified France's data-protection regulator (CNIL) within the required 72 hours. It also announced a plan to contact the 3.5 million affected households with security guidance, and observers warned of likely follow-on phishing and social-engineering attempts.