450,000 FOROM users hit by a data leak

On 19 February 2026, the French Ministry of Sports, Youth and Community Life — operator of FORÔMES (often referred to as FOROM), the national platform that manages training programmes, candidates and diplomas for sports and youth-work professions — disclosed that personal data on roughly 450,000 candidates had been exfiltrated from the system.

According to the ministry, attackers gained access by compromising the legitimate account of a training organisation authorised to use the platform, then used it to siphon out the underlying candidate records. There was no exploitation of a software vulnerability in the platform itself; the breach stemmed from the abuse of trusted third-party credentials. The hacker group DumpSec subsequently claimed responsibility and put the data up for resale.

The exposed records included:

• First and last names
• Email and postal addresses
• Phone numbers
• Dates and places of birth
• Diploma / qualification levels, where recorded

Because FORÔMES handles sports-training candidates, minors were among those affected, heightening the sensitivity of the leak.

In response, the ministry suspended access to FORÔMES to secure and remediate the infrastructure, mobilised its operational security centre (COSSIM) with support from France's national cybersecurity agency ANSSI, filed a criminal complaint, and notified the data-protection regulator CNIL. The ministry said it would notify affected individuals and scheduled cybersecurity briefings for sports-federation IT leads, acknowledging broader exposure across French sports bodies.