French shooting federation confirms theft of 64,000 members' ID photos

Don't open the door, note the number, call 17. That is the instruction in the statement published on October 22 by the French Shooting Federation (Fédération française de tir, FFTir). The federation confirms it suffered a “new attack, separate from the 2025 one.” It reminds its members that law enforcement does not call, and does not show up on its own to collect firearms as a result of this leak.

According to the federation, the attack took place from October 12 to 15. The attacker logged into EDEN, the members' online portal, using accounts whose credentials they had obtained or guessed. They then viewed other shooters' data. They retrieved about 64,000 ID photos and nearly 19,000 documents uploaded by members, including medical certificates of fitness for sport shooting. For 55 people, the full file was copied: the FFTir is contacting them one by one.

How was the intruder spotted?

At the same time, the attacker was making mass queries to the license verification function of the Cibles Couleurs site, which records shooters' progression levels. Their address was blocked on the evening of October 12, and the hosting provider alerted the federation the next day. The function was shut down and fixed on October 15. EDEN documents have been inaccessible since the 16th, the day a criminal complaint was filed.

The following weekend, the attacker posted a sample of the data online, freely accessible. They then tried to take over accounts on Cibles Couleurs, which has been shut down. On EDEN, tens of thousands of login attempts were blocked, according to the FFTir. ANSSI (France's national cybersecurity agency) and the CNIL (the French data protection authority) have been informed.

What leaked, and what didn't

Besides the photos and documents, the federation lists last name, first name, club, age category, Cibles Couleurs level and disability sport status. For former members who haven't renewed in two seasons, identity, date of birth and city of birth are also affected. The FFTir states, however, that bank details, passwords and postal addresses are not affected. No information on firearm ownership could have leaked, it adds, since it does not hold any.

The hacker, for their part, claims far more. According to the site FrenchBreaches, cited by franceinfo, they say they hold information on 587,000 current and former members. The federation does not confirm this total. Its caution is explained by the 2025 precedent: according to the Paris prosecutor's office, cited by franceinfo, the data stolen in October 2025 was used to burglarize members and steal their firearms. On October 18, we reported on the claimed sale of members' medical certificates.

Best practices for members and clubs

According to the federation, obtained or guessed credentials were enough to get into EDEN. The federation's advice:

• be wary of any call, email or visit claiming to be from the police or gendarmerie, and give no information over the phone; if in doubt, call 17;
• never send a password or bank details by email, and don't open unexpected links or attachments;
• if your photo is used on a fake profile, report it to the platform concerned and keep a screenshot;
• club officials: change your passwords, enable two-factor authentication, and never send a member list by email or messaging app;
• for any question: incident@fftir.org or dpo@fftir.org; to file a complaint, contact the CNIL.

The federation says two-factor authentication will soon be mandatory on EDEN (it already is on ITAC, its other application), along with penetration tests, code audits and a new platform. Cibles Couleurs will remain closed until its security has been fully verified. What the attacker will do with the rest of the data remains to be seen.