Data leak at Union Nationale du Sport Scolaire

On 7 July 2025, the Union Nationale du Sport Scolaire (UNSS) — France's national school-sports federation — was revealed to have suffered a massive data leak affecting its membership base. According to reporting and the work of security researcher Clément Domingo (SaxX), around 7.8 million profiles of current and former licensees, mostly secondary-school pupils, were exposed.

The breach stemmed from compromised credentials rather than a sophisticated intrusion. Two minors (aged 13 and 17) obtained the login of an official in the Bordeaux academy — a password reused across services and recovered through a RedLine infostealer infection. Using those administrator accounts on UNSS's OPUSS intranet, they automatically scraped the federation's member database. The teenagers said their motivation was to demonstrate the platform's poor security rather than financial gain.

Exposed data categories reportedly included:

• First and last names, dates of birth
• Email and postal addresses of members and parents
• Phone numbers
• School (establishment), class and activities
• Membership/licence details, photos and disability information

The incident was reported to the CNIL and ANSSI. However, coverage noted the database remained accessible to other actors for months after the initial intrusion, leaving the status unresolved. This July 2025 intranet leak is distinct from the later, separate February 2026 episode in which extracts and roughly 1.5 million pupil photos were published on the dark web.