One hijacked account exposed member data at FFME, France's climbing federation

One account was enough. On Wednesday, October 28, 2026, someone logged into myFFME, the app of the Fédération française de la montagne et de l'escalade (FFME, the French mountaineering and climbing federation), using a fraudulently obtained user account. The intruder was able to view members' personal data. In a statement dated October 30, relayed by the specialist site PlanetGrimpe and by Fuites Infos, the federation attributes the incident to the “fraudulent use of a user account.”

The FFME has not said which account was involved, how its credentials were obtained, or how many members are affected.

Who is affected, and what data?

According to the statement, the access concerns two groups:

• members holding a federal certification, which notably covers people trained in coaching and instruction, or a level passport;
• people who had requested a change to their personal information on the platform.

The data that may have been viewed includes last name, first name, gender, date of birth, email address, license number and training record. The FFME says that passwords, payment information, bank details, postal addresses, phone numbers and documents uploaded to the platform are not affected.

Because many climbing members are minors, Fuites Infos advises parents to warn their children about unexpected messages.

A second alert in ten months

This is not a first for the federation. In January 2026, it had already announced fraudulent access to its management platform, again through a user account. The scenario recalls that of other sports federations in recent weeks, such as the French Shooting Federation. In these cases, no specific technical method has been made public: access came through user accounts.

Best practices for members

With a name, a date of birth, an email address and a license number, a scammer can write a very convincing message in the name of the federation or a club: license renewal, training course, insurance to be settled. The FFME and the sites relaying the news recommend that members:

• never send a password or bank details by email or phone;
• check the sender's address and not log into myFFME from a link received by email: type the site address yourself;
• if in doubt, write to the federation's data protection officer at dpo@ffme.fr;
• in case of fraud, get free help at cybermalveillance.gouv.fr.

Two questions remain open: how many members are affected, and will the federation limit what each account can view, given that the same scenario already happened in January?