April 2026: France's basketball federation FFBB confirmed unauthorized access to a large part of its licensee database, detected the evening of April 17, 2026. Investigators say a hijacked user account abused the federal licence-management tool and pulled identity, contact, and club-licence data for up to about 2 million licensees plus roughly 900,000 legal-representative records.
What FFBB said
In its April 29 notice, FFBB stated the stolen fields were identity (name, DOB), contact (postal address, email, phone), and licence/club affiliation. It said no bank details, passwords, or health/sensitive data were compromised—important because marketplace posts had waved medical-certificate fields. Partial dark-web disclosure occurred; CNIL and ANSSI were notified.
Libération reported the HexDex-linked operator—already tied to a wave of French sports-federation breaches—was arrested around April 20–21, after which circulated files were removed. Copies may still exist offline.
Who should act
Current and recent FFBB licensees and parents listed as legal representatives—especially minors' households.
What you should do
- Ignore messages pretending to be FFBB that ask for passwords, IBANs, or “licence renewal fees.”
- Report suspicious mail/SMS via cybermalveillance.gouv.fr.
- Canonical record: FFBB 2026 on BreachHistory.
Sources: FFBB; Libération.