On 17 October 2026, a seller announced on a cybercriminal forum the sale of data on 586,854 people from the French Shooting Federation (FFTir). The federation has not confirmed the breach. It comes a year after a confirmed intrusion into its systems, followed by warnings about fake police officers turning up at members’ homes. Here is what we know, what remains to be checked and what members should do.
What does the seller claim?
According to Cyberattaque.org, the sale is announced by a hacker calling themselves “ChimeraZ”, who names fftir.org as the source of the files. The figures below are the seller’s:
- An archive of about 40 GB, covering 586,854 people drawn from 988,569 lines. The number of lines is not the number of distinct people.
- About 586,000 licence records: licence number, identity, club, sports category, a flag for disability sport, and a full postal address for some people.
- About 400,000 first-login records and data on about 1,600 clubs.
- About 64,000 ID photos and about 19,000 medical certificates or licence badges.
What is verified, and what is not
Nothing is confirmed by the federation at this stage. Several outlets have, however, seen samples:
- Cyberattaque.org says it obtained samples, with records carrying September 2026 dates, including a licence validation.
- Fuites Infos analysed a 300-line sample: 200 members and 100 clubs from Alsace, including 25 minors. Date and place of birth, nationality, photos and medical certificates could not be verified.
What remains to be established: the authenticity of the full archive, the announced figures, and the central question of whether this is a new intrusion or data already stolen in 2025. None of the sources consulted establishes a technical link between the two. The announced volume also exceeds the number of current members, about 300,000 according to Fuites Infos, which suggests former members are in the files. FrenchBreaches mentions, in an update, about 250,000 active and 350,000 former members.
One point deserves attention: in 2025, the federation said no medical, banking or weapons-ownership data was involved. Cyberattaque.org nevertheless reports that the FFTir confirmed medical certificates are filed in its EDEN space. If the archive really contains certificates, that would be health data.
Reminder: the 2025 intrusion
The FFTir suffered an intrusion between 18 and 20 October 2025. According to the Paris prosecutor, about 250,000 active members and 750,000 former members were affected. An 18-year-old, suspected of taking part in the leak and the resale of the data, was arrested and formally charged in January 2026, as reported by FrenchBreaches.
The real danger: fake police officers
For shooters, the most concrete risk is not spam. On 7 November 2025, Cybermalveillance.gouv.fr warned that criminals were using this data to pose as banks, insurers, operators or law enforcement, and to scout homes for thefts by ruse or break-in, notably to seize weapons. Attempts had already been reported, according to awareness sheet.
In Besançon, a weapon was stolen on 13 November 2025 from a former member, then two men posing as DGSI agents visited a private individual on 2 December and asked to see his weapons; they fled when the victim called the police, as explained by Ma Commune. The outlet cites no source establishing a link with the leak, so the link remains presumed. Doubs police remind that home visits to legal gun owners are forbidden under administrative policing: any entry under that pretext must be treated as fraudulent.
Further context, reported by L’Essor: on April 8, 2026, the French interior minister mentioned 20 to 30 burglaries targeting gun owners, “potentially linked” to the 2025 hack, with perpetrators posing as police officers or gendarmes. The federation claims a direct link to data sold on the darknet. That link is not established by an independent source and does not concern the October 17 claim.
An important precision: appearing in a members’ file does not tell whether the person owns a weapon, or where it is kept, according to FrenchBreaches.
The other risks
- Phishing and identity theft based on names, addresses and contact details: fake emails from the federation, a club or an insurer.
- Minors, present in the sample analysed.
- ID photos and medical certificates, if real: they are used to build fake files and concern people’s health.
What to do if you are a member
- On a suspicious call: give no personal information (work hours, holidays, whether you are home), note the number shown, hang up and call 17. According to Cybermalveillance, the police, gendarmerie and customs will never call to come and collect your weapons because of this leak.
- On a visit: don’t open the door, ask for the professional ID (credit-card format, with photo) and call 17 immediately. In plain clothes, an officer wears an armband with a 6-digit identification number.
- Emails and texts: don’t click any link. Go through the official website of the federation or your club, and report fraudulent messages to Signal Spam or to 33700 for texts.
- Password: change the one for your member account, and for any other service where you reused it.
- In case of identity theft: file a complaint and keep the evidence. You can also contact the CNIL, the French data protection authority.
- Tell your club and wait for official information from the federation.
What should clubs and federations take away?
The technical scenario mentioned by FrenchBreaches (a compromised account without two-factor authentication, an IDOR-type flaw, detection during exfiltration) remains to be officially confirmed. Whatever the cause, the lessons are classic:
- Enable two-factor authentication on accounts that access member files.
- Check permissions on every object: an account should only see its own club’s records.
- Alert on mass exports and unusual access.
- Keep the minimum: medical certificates and former members should not stay in databases indefinitely.
Sources: Cyberattaque.org, Fuites Infos, FrenchBreaches, Cybermalveillance.gouv.fr and Ma Commune.
Frequently asked questions about the French Shooting Federation breach
No, not at this stage. It is a seller’s claim on a cybercriminal forum, with samples that some outlets have seen. The federation has not confirmed.
The seller announces 586,854 people from 988,569 lines. This figure is not verified and probably includes former members.
The seller claims about 19,000 medical certificates and badges. This is not verified. Watch the federation’s official communications.
Don’t open, ask for the professional ID and call 17. Law enforcement does not come to collect weapons because of this leak.
None of the sources consulted establishes it. It may be data stolen in 2025 or a new intrusion: the investigation will have to say.
Leave a Reply