French Football Federation experiences data breach following cyberattack

Du'aine Davis

Observed in the wild

• On 26 November, the French Football Federation (FFF) reported a cyberattack on software used by football clubs for administrative management. The breach exposed personal data of licensees, including names, birth details, nationality, contact information, and license numbers. Authorities such as ANSSI and CNIL have been notified, and affected individuals will receive direct communication.
• The attack was executed via a compromised account, granting unauthorised access to the system. The FFF immediately deactivated the account and reset all user passwords to contain the intrusion. No mention of specific threat actors was provided, but the incident reflects growing cybercrime targeting sports organisations.
• Organisations are urged to remain vigilant against phishing attempts and suspicious communications (emails, SMS, calls) requesting sensitive data or containing attachments. The FFF recommends password resets and heightened scrutiny of account activity. Microsoft Defender users should enable advanced phishing protection and monitor for anomalous login behaviour indicative of credential compromise.

November 26 Data Theft News Release | French Football Federation (FFF) | Official Website