The French Football Federation (FFF) has just confirmed a new data breach, the second in less than a year. After the incident in February 2025, during which a hacker had already exfiltrated and published the data of 43,681 referees and officials, a database of 184,762 lines containing identities and email addresses, it is now the centralized administrative platform of the clubs that has been compromised.
In February, the attack stemmed from the exploitation of unauthorized access that allowed the hacker to extract a complete database specific to referees, which he then reposted online on February 28, 2025, boasting about it publicly.
This time, in November 2025, the vector is different but just as concerning: a compromised user account granted cybercriminals administrator rights on the federal software used by all clubs. This privilege escalation allowed access to sensitive personal data belonging to millions of license holders before the intrusion was stopped.
Fraudulent access through a compromised identifier
According to the official statement published on November 26, 2025, the attack did not result from a software vulnerability, but from access obtained via abused legitimate credentials. As soon as the abnormal activity was detected, the FFF disabled the compromised account and reset all user passwords in order to limit propagation and any attempt at reusing the access.
The competent authorities, ANSSI and CNIL, were informed, in accordance with GDPR requirements, and a complaint was filed. The federation stated that it will directly contact all individuals whose email address appears in the exfiltrated database.
Complete personal data, an increased risk of identity theft
The extent of the compromised data far exceeds that of the February incident. The stolen information includes first and last names, gender, dates and places of birth, nationality, postal and email addresses, phone numbers and license numbers.
This combination forms a “complete identity profile”, highly sought after on the black market. It enables highly targeted phishing attacks, the impersonation of a license holder, the creation of credible fake accounts, or attempts at financial fraud against clubs, leagues or partner organizations. Previous attacks in amateur sports have shown that criminals often use this data to impersonate a club or the federation and trick victims into opening attachments or providing sensitive information.
A sports sector that has become a prime target
With more than 2.3 million license holders during the 2023–2024 season, amateur football represents one of the largest personal data repositories in the French non-profit sector. Technical systems are varied, distributed, and often managed by volunteers with limited cybersecurity training. This decentralization creates a particularly attractive attack surface for malicious groups seeking maximum impact with moderate effort.
For two years, sports federations have faced a surge in attacks targeting their registration portals, administrative services, or internal management systems. The repetition of two major breaches in 2025 within the same federation, one in February and the other in November, illustrates the growing pressure on this sector and the necessity of structural investment in cybersecurity.
Increased vigilance for license holders and volunteers
The FFF warns against phishing risks likely to exploit the stolen data. Victims may receive emails, SMS messages or phone calls impersonating the federation, their club or an official body. Communications may claim to announce a license renewal, a file update, an administrative adjustment or a password change.
The federation reminds that no legitimate organization will ever ask for a password, an authentication code, or a bank card number by message. License holders must also be wary of any invitation to open files or click on unsolicited links.
In this context, the November incident is not just an isolated breach, but the sign of a structural problem. French amateur football, like other non-profit sectors, is now exposed to increasingly professional attacks, exploiting legitimate access and targeting infrastructures that are often insufficiently prepared.
A challenge for the French football ecosystem
The FFF claims to be continuously strengthening its security measures to cope with the rise of cyberattacks. However, the multiplication of incidents in 2025 highlights the urgency of a global approach: access governance, hardening of the systems used by clubs, enhanced awareness for volunteers, and control of privileged accounts.
The data of license holders is no longer a secondary matter: it has become a strategic digital asset, coveted by cybercriminals and essential to the functioning of amateur football. The federation now faces an obligation: to sustainably transform its security posture to prevent these successive breaches from becoming the norm.
Share:
External Attack Surface Management
See your exposure before attackers do. Know what's already compromised.
of successful breaches start from publicly exposed assets.
