Threat actor claims 20 million records from 34 French sports federations
A threat actor on a dark web forum has released a 5.9 GB dump claimed to hold more than 20 million records from 34 French sports federations and related bodies, including the swimming and karate federations and the French Hospital Federation. The CSV and JSONL files have not been independently verified and no breach has been confirmed. Named entities should investigate the data's origin and warn members about phishing.
What happened
A threat actor on a dark web forum claims to have published 5.9 GB holding more than 20 million records from 34 French sports federations and related bodies, including the swimming and karate federations and the French Hospital Federation. The claim has not been independently verified.
Why it matters
If confirmed, the spread across 34 bodies points to a compromised shared third-party platform rather than 34 separate hacks, per DailyDarkWeb's analyst note. Sports licence data often covers minors and medical-certificate details, raising phishing and fraud risk for members and parents.
What to do
Named entities should investigate the data's origin, check for overlap with the October leak of about a dozen federations' licensing data, and warn members and parents about phishing posing as their federation or club.
For the technical team
- Affected
- 34 federações esportivas e órgãos ligados na França, incluindo a Federação Francesa de Natação (ffnatation.fr), a Federa · 34 French sports federations and related bodies, per the claim. Named entities: French Swimming Federation (ffnatation[.]fr), French Karate Federation (ffkarate[.]fr), French Hospital Federation (fhf[.]fr).
- Exploitation
- Threat-actor claim reported by DailyDarkWeb; not independently verified and no breach confirmed. 5.9 GB uncompressed dump in CSV and JSONL, distributed to forum members for platform points.
- Fix
- No fix applicable. Verify data origin, run incident response, communicate with members.
- Vector
- Dump released on an underground forum. DailyDarkWeb's analysis points to a shared third-party platform across the 34 bodies rather than 34 separate hacks. Original component and intrusion vector unknown.
- More details
- DailyDarkWeb reports the dump is larger than the October leak of about a dozen federations' licensing data and may partly overlap with it. Sports licence data often covers minors and medical-certificate details, with phishing risk to members. Source: DailyDarkWeb post on X.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
