The French Football Federation (FFF) confirmed that it was the victim of a significant cyberattack resulting in the theft of personal data from the federation’s member management system. This breach is a major concern for the football community across France, potentially impacting over two million registered amateur football players and club members.
The cyberattack involved unauthorized access to the administrative software platform used by thousands of clubs nationwide to manage player registrations and club memberships. Attackers exploited a compromised user account to infiltrate the system, gaining access to sensitive personal details including names, dates of birth, nationalities, postal and email addresses, phone numbers, and football license numbers. Importantly, financial data and passwords were reportedly not compromised in this incident.
Upon detecting the breach on November 20, 2025, the FFF immediately deactivated the compromised account, reset all user passwords, and secured its systems. The federation swiftly filed a formal complaint with French authorities and notified the national data protection and cybersecurity agencies, CNIL and ANSSI. It has begun contacting affected individuals whose email addresses were exposed to offer guidance and support.
This incident underscores the increasing cyber risks facing sports organizations, which hold vast troves of personal data about their members. The FFF urges all license holders to stay vigilant against potential phishing attempts and scams that may use the stolen data for social engineering attacks. Players and clubs should carefully scrutinize any suspicious communications allegedly coming from the federation or affiliated football clubs.
This breach follows similar cyberattacks on sports organizations globally and calls attention to the critical need for enhanced cybersecurity protections within the sports ecosystem. The French Football Federation is actively working to strengthen its security posture and protect its community’s data as this investigation continues.
For football players and members in France, the key takeaways are to remain cautious with personal information, verify communications rigorously, and report any suspicious activity immediately. Data privacy remains a top priority as the federation fortifies defenses against present and future cyber threats.
