Threat actor claims sale of data on 1.1M FITP members
A threat actor on an underground forum claims to sell data on about 1.1 million members of the Federazione Italiana Tennis e Padel (FITP), including emails, passwords, dates of birth, addresses, phone numbers and Italian fiscal codes. The claim has not been independently verified and FITP has not confirmed an incident; according to DailyDarkWeb, the listing first appeared in mid-October and has resurfaced. Members should watch for FITP-themed phishing.
What happened
A threat actor on an underground forum claims to sell data on about 1.1 million members of the Federazione Italiana Tennis e Padel (FITP), the governing body for tennis, padel and wheelchair tennis in Italy. The claimed dataset includes emails, passwords, dates of birth, addresses, phone numbers and Italian fiscal codes. The claim is unverified and FITP has not confirmed an incident.
Why it matters
According to DailyDarkWeb, if authentic, fiscal codes combined with dates of birth and addresses are highly valuable for identity fraud, and the credentials could enable account takeover on sports-booking and club platforms. The situation also favors phishing scams using the FITP name.
What to do
Monitor FITP official channels for confirmation or guidance. Tell members to change reused passwords and to treat messages about the entity with caution. Strengthen filters and alerts against FITP-themed phishing.
For the technical team
- Affected
- Federazione Italiana Tennis e Padel (FITP) Base de dados de membros da FITP (Federazione Italiana Tennis e Padel), entidade que rege tênis, padel e tênis em cadeira de rodas na Itália; cerca de 1,1 milhão de registros que incluiriam nomes de u · FITP (Federazione Italiana Tennis e Padel) member database: about 1.1 million records claimed. No software product cited.
- Exploitation
- Sale claim on an underground forum reported by DailyDarkWeb on 2026-10-28. The listing reportedly first appeared in mid-October and has resurfaced, with no sample or price visible on the captured post. No technical exploitation reported and no independent verification.
- Fix
- No fix applicable: no software vulnerability was cited. FITP has not confirmed an incident.
- Vector
- Not described in the sources. The origin of the claimed data is unknown; the actor only announces the sale of the dataset.
- More details
- DailyDarkWeb assesses that fiscal codes with dates of birth and addresses support identity fraud and that credentials could enable account takeover on sports-booking and club platforms. It recommends watching for FITP-themed phishing. Two DailyDarkWeb posts cover the case, the second detailing the dataset: usernames, emails, passwords, names, dates of birth, gender and postal addresses.
Timeline
New post details the offered dataset contents: usernames, emails and passwords, plus names, dates of birth, gender and postal addresses.
First disclosure: actor advertises 1.1M FITP member records on an underground forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
- @DailyDarkWeb @DailyDarkWeb
