Data leak at Union Nationale du Sport Scolaire

On 28 February 2026, the Union Nationale du Sport Scolaire (UNSS) — France's national school-sport federation, which licenses well over a million secondary-school athletes each year — confirmed that it had suffered a major data breach. Attackers gained unauthorized access to OPUSS, the federation's digital membership-management platform, and exfiltrated the personal data of its licensees. The stolen files were subsequently published on the darknet, reportedly by a group operating under the name DumpSec.

The most striking element of the leak was roughly 1.5 million identity photographs of children and teenagers aged 11 to 18. The exposed records covered approximately 668,000 members for the 2025/2026 season and around 889,000 members from previous years, and amounted to about 65 GB of data.

Exposed data categories included:

• First name, last name, gender, date of birth and age category
• Class and school establishment
• UNSS licensee ID and insurance / registration details
• Membership registration date
• URLs linking to each licensee's identity photo (~1.5 million images)

Bank details (RIBs and SEPA mandates) and disability-related information were reportedly not part of the leak. The UNSS said the links granting access to the photo images had been disabled, and that it had reset passwords, removed inactive accounts and reinforced authentication. The federation filed a criminal complaint, notified the French data-protection authority (CNIL), and brought in the national cybersecurity agency (ANSSI) to investigate the intrusion and assess its scope.