2026 FFR / Ovale — phishing-linked campaign; ~530K licenciés; forum sale of player data (Mar)

The Fédération française de rugby confirmed a major cybersecurity incident in March 2026 after criminal forum posts—attributed in open sources to a persona such as “Cybernox”—offered a large database said to span licensing records from roughly 2003–2026. French and international press summarized exposure affecting on the order of 530,000 licence holders, with actors also claiming roughly one million player photos and hundreds of national ID (CNI) images, plus injury and administrative metadata. The FFR characterized the root issue as phishing affecting members rather than wholesale direct compromise of a single central database, while still urging password resets and vigilance; CNIL and law enforcement were notified. Victims should rely on federation communications for definitive categories.