Leak at the French Ministry of Sports, Youth and Community Life

On 19 February 2026, the French Ministry of Sports, Youth and Community Life — the central government department overseeing sport and youth/community-life policy — disclosed that data had been exfiltrated from FORÔMES, the information system used to register, manage and consult training programmes, candidates and diplomas in animation and sports. The ministry detected the incident on 20 February 2026, shortly after a threat actor (publicly linked to the "DumpSec" group) advertised the stolen records.

The breach did not stem from a direct intrusion into ministry servers but from the compromise of a legitimate training organisation's account, which had authorised access to FORÔMES. That access was disabled as soon as it was identified. Roughly 450,000 candidates were affected, and reporting indicates minors were among them.

Exposed data categories included:

• Names and surnames
• Email addresses and postal addresses
• Phone numbers
• Dates and places of birth
• Education level and administrative/training information (where provided)

In response, the ministry's information-systems security operations centre (COSSIM) opened an investigation, notified the national cybersecurity agency (ANSSI), and filed a complaint with prosecutors and the data-protection authority (CNIL). Access to FORÔMES was temporarily suspended so corrective measures could be applied before reopening under reinforced security, and affected individuals were to be notified. This incident is distinct from the separate, larger Pass'Sport data breach also attributed to the ministry's ecosystem.