2026 RFEF Coaching Academy — Firebase misconfig claim; DNI docs + 113K auth IDs (unverified)
Data compromised
Actor-claimed: ~16 students with publicly listable files including Spanish DNI scans, profile photos, invoices; Firebase Realtime Database allegedly allowed enumeration of ~113,681 authentication user IDs without PII in those records—unverified
Technical writeup
Unverified cloud-misconfiguration claim — July 15, 2026. BreachNews reported a forum actor alleged Firebase storage on the Royal Spanish Football Federation coaching academy site (academia.rfef.es) allowed unauthenticated listing/download of student enrollment files, including Spanish national ID (DNI) scans for roughly 16 users, plus profile photos and invoices. The same claim alleged Firebase Realtime Database enumeration of about 113,681 authentication user identifiers without PII in those auth records. RFEF had not issued a matching public statement at indexing time. BreachHistory indexes recordsAffected 16 for the actor-cited identity-document cohort (not the 113K auth-ID enumeration) and labels the incident unverified.
Root cause
Unverified forum claim of misconfigured Firebase storage/Realtime Database on academia.rfef.es exposing student identity documents without authentication—RFEF had not confirmed at catalog time