A year after the breach, a hacker is selling medical certificates of French shooting federation members

On October 17, a new listing appeared on a cybercriminal forum. The seller claims to hold 40 GB of files from the French Shooting Federation (Fédération française de tir, FFTir): 586,854 people, about 64,000 ID photos and 19,000 documents, including medical certificates and license badges. The specialized sites FrenchBreaches and Fuites Infos relayed the claim the same day.

At this stage, nothing is confirmed. The federation has not commented on the listing, and all the figures come from the seller. One detail calls for caution: according to Fuites Infos, the FFTir itself claims about 300,000 members, fewer than the announced volume. Fuites Infos notes that this volume has not been verified.

A sample that holds up

Fuites Infos analyzed a 300-line extract published by the seller. It covers 200 members and 100 clubs in Alsace. Of those 100 clubs, 95 match the federation's public directory by name and address. A little over half of the records include a postal address, and 25 members belong to youth categories, meaning they are minors. However, neither the ID photos nor the medical certificates could be verified.

According to FrenchBreaches, the intrusion allegedly began with a compromised account that was not protected by two-factor authentication. The hacker then allegedly exploited an access control flaw by cycling through internal identifiers. This version comes from the hacker and is unconfirmed. FrenchBreaches also stresses that nothing currently allows this listing to be technically linked to the 2025 attack.

Why this leak is more worrying than others

The FFTir was already hacked between October 18 and 20, 2025. According to the Paris prosecutor's office, cited by FrenchBreaches, about 250,000 current members and 750,000 former members were affected. The official website Cybermalveillance.gouv.fr (France's national cybercrime victim assistance service) stated at the time that civil status, contact details and license numbers had leaked, but no medical or banking data.

What followed showed what those addresses could be used for. On April 8, 2026, Interior Minister Laurent Nuñez said that 20 to 30 burglaries were potentially linked to the leak, according to L'Essor. Criminals posed as police officers or gendarmes to get hold of weapons. An 18-year-old was charged in January 2026.

If the new claim is confirmed, the file would be richer than the 2025 one: identity documents, health data and minors. It is a scenario close to the claimed leak at the Climb Up climbing gyms, but with a far more exposed population.

What members should do

• Law enforcement will never come to your home or call you to collect your weapons because of a data breach, Cybermalveillance.gouv.fr reminds people.
• Be wary of calls, text messages or emails that mention your club, your license number or your federation. Call the organization back through its official channels.
• Never hand over a password, a code or a copy of an ID document in response to a request you did not initiate.
• In case of identity theft, keep the evidence and file a complaint. You can also contact the CNIL (the French data protection authority).

The main question remains: is this a new intrusion, a still-open access, or old data repackaged? Only the federation can answer.