The French Football Federation (FFF) has just announced a new cyberattack affecting the administrative management software used by clubs. This data breach, detected on 20 November 2025, allowed attackers to access licensed players’ personal information through a compromised account. This FFF cyberattack comes less than two years after a similar attack that had already hit the federation.
Data compromised in the FFF cyberattack
The breach concerns licensed players’ identification data, including surname, first name, gender, date and place of birth, nationality, postal and email address, phone number and licence number. The federation states that passwords, bank details and medical data are not affected by this FFF cyberattack.
As soon as the intrusion was detected, the teams disabled the compromised account and reset the passwords of all user accounts. This quick response helped limit the scope of the security breach.
Measures taken after the FFF cyberattack
In line with the GDPR, a complaint was filed and the relevant authorities, ANSSI and the CNIL, were informed. The federation is contacting the people whose data was in the compromised database directly by email.
This new FFF cyberattack raises questions about the security of French sports federations’ information systems. The French Shooting Federation had also suffered a similar attack in October 2025, suggesting these organisations are prime targets for cybercriminals.
Risks for licensed players
Victims of this FFF cyberattack need to be extra vigilant about phishing attempts. The federation urges the utmost caution with suspicious communications claiming to come from the FFF or clubs, especially those asking you to open attachments or share banking credentials.
The stolen data can be used to run targeted phishing campaigns in which attackers use their knowledge of personal information to gain victims’ trust. Licensed players should always check that messages are genuine before taking any action.
The growing number of these incidents shows that sports organisations need to strengthen their IT security infrastructure and adopt more robust protection measures against constantly evolving cyber threats.
Frequently asked questions
The compromised data includes surname, first name, gender, date and place of birth, nationality, postal and email address, phone number and licence number. Passwords and bank details are not affected.
The FFF detected unauthorised access through a compromised account on 20 November 2025. The teams immediately secured the system by disabling the account and resetting all passwords.
Licensed players may be targeted by phishing attempts that use their personal data to gain their trust. Be wary of suspicious emails, text messages or calls asking for sensitive information.
Yes, the FFF filed a complaint and informed ANSSI and the CNIL in line with the GDPR. An investigation is under way to identify those responsible for the intrusion.
Leave a Reply