French table tennis federation confirms new breach as hacker claims to sell 1.6 million records

On November 5, shortly after 2 p.m., a listing appeared on a cybercrime forum. Its author, who goes by ChimeraZ according to the site Cyberattaque.org, is selling a database attributed to the French Table Tennis Federation (Fédération française de tennis de table, FFTT). The seller claims 2,220,815 rows covering 1,645,606 people, 9.3 GB of data and about 42,800 files, including 1,864 identity documents and 383 proofs of address.

None of these figures has been verified. The federation has not publicly confirmed the hack: as of November 6, no statement on the matter appeared in the news section of its website. Two leak-tracking sites, Cyberattaque.org and Fuites Infos, did analyze the sample released by the seller.

Minors and medical certificates in the sample

The sample contains 925 usable records. They include name, date of birth, postal address, phone number and email address, as well as license number, club, category and ranking. According to Cyberattaque.org, 430 records list a doctor's name and registration number along with the dates of a medical certificate, and 392 contain a field linked to a health questionnaire. There is no sign of any diagnoses, however. The site also notes 42 records of people who would still be minors today. It found no passwords or bank details in this extract.

The identity documents and proofs of address that were advertised are absent from the sample, Fuites Infos points out. Their existence therefore remains to be proven.

A 2025 leak resurfacing?

The FFTT has been hacked before. In September 2025, it acknowledged a cyberattack: a compromised account had allowed mass extraction of information from its license-holder database. The data included license number, last name, first name, sex, date and place of birth, nationality, address, email and phone number. The federation said at the time that “no bank details or health data” had been affected. It filed a complaint and notified the CNIL (the French data protection authority) and the ANSSI (France's national cybersecurity agency).

The new sample muddies the picture. According to both Fuites Infos and Cyberattaque.org, some records were modified as late as October 11, 2025. That date falls a few weeks after the federation's statement. Neither site concludes that there was a new intrusion. Is this the 2025 data, a later extraction or a patchwork? Only the federation can say. It would not be the first sports federation targeted: those for sailing and shooting confirmed data thefts in October.

What current and former license holders should do

With this type of file, the main risk is a personalized scam. A message that knows your club, your license number or the date of your certificate easily inspires trust.

• Be wary of emails, texts and calls claiming to come from the FFTT, your club, the national health insurance system or a supplementary health insurer. Log in only through the official website or app.
• Never share a code received by text message, a password or your bank details.
• Change your FFTT password, and anywhere else you reused it, and enable two-factor authentication where available.
• Warn children who hold licenses: a message that cites their club or category is not proof that it is genuine.
• If your identity is stolen, file a complaint and get help from cybermalveillance.gouv.fr.

What happens next is up to the FFTT: confirm or deny, and say where these records came from.

Update of November 12, 2026

On November 5, a seller calling themself ChimeraZ put up for sale on a cybercrime forum a database attributed to the French Table Tennis Federation (FFTT), which they said covered 1.6 million people. In a statement published on its website and relayed on November 9 by Fuites Infos and FrenchBreaches, the federation confirms a new intrusion, separate from the September 2025 cyberattack. Some records do carry dates “up to October 11, 2025, after the September 2025 cyberattack.” As in September 2025, a compromised account allowed mass extraction of information from the license-holder database. The FFTT does not say how many people are affected.

According to the federation, the data affected includes license number, last name, first name, gender, date and place of birth, nationality, postal address, email and phone number. Also included is metadata from medical certificates: the doctor's name and registration number, the certificate date, and information from the health self-questionnaire. The disclosure of their full content is not confirmed, however, it says. Copies of ID cards, passports and proofs of address or employment, notably those provided for transfers between clubs, would also be affected. On this point, the FFTT repeats the hacker's claim: “the actual presence of all these documents in the full archive could not be verified.” No passwords or bank details were found in the sample examined.

The federation filed a complaint and informed the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL) and the national cybersecurity agency (Agence nationale de la sécurité des systèmes d'information, ANSSI). It advises license holders to change the password for their SPID account, the federation's online tool, and to be wary of messages claiming to come from it. Questions can be sent to cyber@fftt.org. For its part, FrenchBreaches says it alerted the FFTT as early as October 27. According to the site, the federation then said it had identified a compromised license-holder account and a flaw tied to an API (application programming interface), acknowledging that the vulnerability “could still be exploited from another compromised account.” The official statement does not mention this flaw.