French Sailing Federation confirms theft of more than two million personal records

More than two million individual records, for a federation that issues about 295,000 licenses and passes this year. The figure announced on October 23 by the Fédération française de voile (FFVoile, the French Sailing Federation) far exceeds its current number of participants. The explanation is simple: the leak reaches far back in its history, all the way to former members.

According to the notification sent to members and relayed by Fuites Infos and Cyberattaque.org, a “fraudulent access” to the federation's databases allowed these records to be extracted. The federation spotted the incident on October 19. The attacker exploited a flaw in an internal tool used to view and analyze its data. FFVoile does not say how many distinct people are affected.

Who is affected, and by what?

The leak affects members and former members, holders of the club license and the Passeport Voile, as well as some affiliated organizations. The data extracted, according to the federation:

• last name, first name, date of birth and sex;
• postal address, email address and phone number;
• the history of licenses, clubs attended and sports activity;
• the bank details (IBAN) of some clubs, which the federation says it is contacting directly.

According to the federation, information on medical fitness could also be in the batch: this point remains to be verified. However, according to the federation's investigation, no medical certificate was downloaded, and neither passwords nor members' personal bank details are affected.

The federation's second leak this year

In February 2026, FFVoile had already reported the extraction of data on several hundred thousand members, via a compromised club account. The federation says the October incident is unrelated. It says it fixed the flaw on the day it was discovered, restricted access to the tool and reduced data access rights. The CNIL (the French data protection authority) and the ANSSI (France's national cybersecurity agency) have been notified, and a complaint will be filed. The technical nature of the flaw and how long it may have been exploited are not known.

Sports federations are clearly targets this season: the French Shooting Federation confirmed the theft of 64,000 ID photos the same week.

Best practices for members

There are no passwords or bank card numbers in this leak: the main risk is targeted scams, made believable by the name of your club and your sports history.

• Be wary of emails, text messages or calls claiming to come from FFVoile, your club or a health insurer. Use the official website or app rather than a link you received.
• Never give a code received by text message, a password or bank details to someone who contacts you.
• Club treasurers whose IBAN leaked should monitor direct debits: an unauthorized debit can be contested for 13 months.
• If in doubt, the website cybermalveillance.gouv.fr offers free assistance.

One question remains open: why did an analysis tool give access to records of former members, some of whom left years ago? The European data protection regulation (GDPR) requires that data be kept only as long as necessary. The CNIL, now notified, could look into it.