2026 FFBB — licensee database breach; up to ~2.9M people (HexDex)
Data compromised
Identity (name, DOB), contact (postal address, email, phone), licence and club affiliation; FFBB states no bank details, passwords, or health/sensitive data compromised. Actor listings also alleged medical-certificate fields—federation denied health-data compromise.
Technical writeup
Fédération Française de Basket-Ball (FFBB) confirmed a security incident detected the evening of April 17, 2026: fraudulent access to a user account enabled misuse of the federal licensee-management tool and unauthorized extraction of personal data concerning up to about 2 million licensees plus roughly 900,000 additional records for legal representatives of licensees (~2.9M people). Extracted data: identity, contact details, and licence/club affiliation; FFBB stated bank data, passwords, and health/sensitive data were not compromised, while noting partial dark-web disclosure. CNIL and ANSSI were notified; a complaint was prepared. Trade press (Libération) reported the HexDex-linked actor—also tied to other French sports-federation breaches—was arrested around April 20–21, 2026, after which circulated files were taken down. Earlier HexDex marketplace claims cited ~1.926M members and ~800k parents.
Root cause
Fraudulent access to a user account enabling misuse of the federal licensee-management tool (éditions module); actor HexDex sold/leaked data before arrest
References
- https://www.ffbb.com/actualites/la-ffbb-informe-dun-acces-non-autorise-a-ses-donnees-licencies
- https://www.liberation.fr/societe/cyberattaque-la-federation-francaise-de-basket-victime-a-son-tour-dune-fuite-de-donnees-deux-millions-de-personnes-concernees-20260430_YHXLVM2WIFFLBBCITHLTMZMAUM/
- https://darkwebinformer.com/french-basketball-federation-breached-1-9-million-members-and-800k-parents-exposed-with-addresses-medical-certificates-and-minor-data/