A new claim targeting ffhandball.fr
On August 10, 2026, a hacker posted on a clandestine forum a claim of intrusion targeting ffhandball.fr, the domain of the French Handball Federation (FFHB). The author is selling a database reported to have 1,367,197 lines and presents a sample archive intended to prove possession of the data.
According to its description, the attacker allegedly gained initial access through already leaked credentials — a scenario that strongly suggests the exploitation of logs from a stealer (malware that steals credentials stored in browsers). This access reportedly opened the doors to an internal tool of the FFHB allowing for searches on licenses and individuals registered with the federation.
A bypass of club filtering
The central technical point of the claim concerns the bypassing of an authorization mechanism. The interface of the internal tool normally limited each user to licenses associated with their own club. The hacker claims to have managed to bypass this restriction to consult and extract a much wider scope.
The cybercriminal mentions approximately 311,000 licenses retrieved, as well as holding information about "millions" of registered individuals. It should be noted that the volume of 1.3 million lines reported in the database for sale does not directly correspond to the number of victims: a single person can appear in multiple records, histories, or data categories. The estimation of "millions of people" suggested by the attacker is not supported by any verifiable element in their publication.
Personal documents at stake
The most concerning aspect of this claim concerns personal documents. The hacker indicates having retrieved a limited but sensitive number of:
- National identity cards
- Passports
- Medical certificates
- Other personal documents
Such documents present a significantly higher risk than a simple file of contact details. They can provide actionable information for attempts at identity theft, document fraud, or targeted social engineering. The dissemination of a sample archive aims to demonstrate possession of these data to potential buyers.
A familiar modus operandi: account compromise + lack of authorization
The claim does not detail any specific technical vulnerability — neither compromised software nor identified exploitation mechanism. The only point explicitly described is the initial use of already exposed credentials, followed by a bypass of club filtering.
This scenario — account compromise combined with a lack of authorization control after authentication — fits a well-known pattern. A user with legitimate access limited to their own scope manages to reach data normally outside their perimeter because the application trusts the authenticated identity without finely checking the rights at each request. This type of flaw, sometimes referred to as broken access control or IDOR (Insecure Direct Object Reference), regularly appears among the most critical categories in the OWASP ranking.
A precedent in October 2025: 2.7 million entries
This is not the first time the FFHB has appeared in a data leak. In October 2025, a hacker had already leaked a database from the Federation containing 2,733,580 entries, including names, first names, and email addresses — the latter not being filled out for all accounts. The data concerned presumed current and former licensees of the sports federation.
A few weeks later, in November-December 2025, FFHandball publicly acknowledged a cybersecurity incident. In an official statement published on its website, the federation indicated that "the software used by clubs, committees, and leagues for their administrative management and particularly that of their licensees was the victim of a cyber malice action with unauthorized access." The measures taken included neutralizing the affected accesses, resetting user account passwords, and reinforcing controls. A complaint has been filed, and the relevant authorities — notably the CNIL and the ANSSI — were informed.
At that time, the federation had called on its licensees to "be vigilant towards any suspicious communication (SMS, call, email) appearing to come from FFHandball, their club, or a third party."
A tense ecosystem of French leaks
The FFHB is not an isolated case. French sports federations are a recurring target for cybercriminals, as documented in an investigation by ZATAZ published in December 2025. A few days before the announcement from the FFHB, the French Football Federation (FFF) had confirmed its own data theft via a compromised account, mentioning that the leak was limited to personal and contact information (name, first name, gender, date and place of birth, nationality, postal address, email address, phone number, license number). This marked the third time in less than two years that the FFF had fallen victim to hacking.
A hacker claiming to be affiliated with the Shiny Hunters group also claimed attacks against the French Swimming Federation, the French Tennis Federation, and the Karate Federation, accompanied by defacements displaying political slogans. Beyond sports, the same actor targeted a subdomain of MAIF and an educational Belgian site.
More broadly, ZATAZ's analysis of “look-up pirates” revealed the existence of a real criminal economy structured around French personal data. An identified actor operates an infrastructure indexing over 500 million lines predominantly in French, accessible via Telegram and Discord bots following a “free trial, paid revelation” model. The French Handball Federation was already listed with 2.7 million records, alongside basketball (2.6 million), swimming (2.8 million), or even UNSS (7.7 million student files).
A pseudonym linked to several French leaks
The pseudonym associated with this new claim from FFHandball — reported under the name ZeroBytes on the PwnForums — is not new to publishing. The same account is linked to several sale offers concerning French organizations:
| Organization | Announced Volume |
|---|---|
| Intermarché | ~1.3 million records (the retailer indicated less than 250,000 people affected) |
| SFR | ~2.1 million entries |
| Accor | ~162,000 entries |
| Bureau Vallée | — |
| EVA (competitive virtual reality) | — |
These publications sketch the activity of an account that recently appeared on the forum and focused on French targets, with volumes ranging from 162,000 to over 2 million records. However, caution is advised: on clandestine forums, a seller can be the author of the intrusion, an intermediary, a reseller, or simply the distributor of a database obtained from a third party. For FFHandball, the attacker claims direct access to the internal tool, which distinguishes this publication from other offers associated with the same account.
SFR, for its part, recently notified its customers of unauthorized access targeting a tool related to connections on the fixed network, with a possible exposure of identification and contact data. The operator reported the incident to the CNIL and filed a complaint.
Key takeaways
- New leak claimed on August 10, 2026, against FFHandball, with 1.3 million lines and personal documents.
- Modus operandi: exploitation of compromised credentials (probably via stealer) followed by bypassing club filtering — a lack of access control.
- Recurrence: the FFHB had already suffered a leak of 2.7 million entries in October 2025 and acknowledged an official incident in November-December 2025.
- Systemic context: French sports federations are recurring targets, in an ecosystem where stolen data feeds "look-up pirates" marketing access to hundreds of millions of French records.
- Recommendation: licensees and clubs should remain vigilant against any suspicious communication (SMS, email, call) mentioning the federation, and never transmit confidential or banking information in response to unverified solicitations.
At the time of writing this article, the French Handball Federation had not published any further statement regarding this claim from August 2026. It will be important to monitor any potential official confirmation of the incident, as well as any notification to the CNIL in connection with GDPR obligations.