On 5 March 2026, the French Gymnastics Federation (FFGym) reported unauthorised access to some data concerning 2.9 million current and former licence holders through FFGym Licence. Depending on licence history, the exposed fields included identity, date of birth, address, email, phone number and licence number. FFGym said no banking or medical data had been compromised and no fraudulent use had been observed at that date.
FFGym said access came through a compromised club account, probably after phishing, and reported that about twenty federations had suffered cyberattacks in the preceding weeks, most attributed by the federation to the same attacker. Other cases were reported separately: on 11 August, the French Handball Federation said unauthorised access to Gest’Hand had been detected and its assessment was ongoing. The French government separately announced on 17 August that a suspect had been arrested on 20 April in connection with around 100 suspected compromises, including attacks on sports federations and the Ministry of Education. No source reviewed links these separate events to the FFGym incident.
What the sources establish about FFGym
The 2.9 million figure refers to current and former licence holders whose profile data was affected by the unauthorised access, according to FFGym. For recent licence holders, the federation lists name, date of birth, sex, postal address, email, phone number and licence number. Some contact fields were not listed for former licence holders. The figure therefore does not mean passwords or banking details were exposed: FFGym said no banking or medical data had been compromised.
How a club account can become an entry point
In FFGym’s account, the attacker entered FFGym Licence through a compromised club account, probably following phishing intended to obtain login credentials. The federation has not publicly explained how those credentials were captured, so phishing remains a likely cause rather than a proven method. FFGym later enabled SMS two-factor authentication for its applications, including FFGym Licence, on 20 May 2026. This adds a check beyond the password, but is not a reason to keep sharing one login among volunteers.
Shared accounts or accounts left active after a volunteer leaves can make it harder to identify who is responsible and revoke access. Clubs can make reviews easier by distinguishing named accounts from shared ones and limiting each account to the tasks it needs.
Checks for volunteers and administrators
- Check notices through the federation’s official website and follow its current instructions. FFGym required its users to change their passwords before access was reopened after the incident.
- For FFGym Licence, use the SMS two-factor authentication introduced on 20 May and ask your club for an individual account if logins are still shared.
- Change passwords reused elsewhere and review the email accounts and recovery methods linked to club tools.
- After a breach, decide which passwords to change first instead of changing every unique secret without a reason.
Organising access in a small organisation
Federations and clubs can inventory accounts that access licence records, member exports, mailboxes and event tools. Assign an owner to each account, remove former members and avoid sharing one password with an entire team. Our SMB password policy guide can help define these rules; for necessary shared access, see the team password-sharing guide.
The Soclyde connection
Soclyde does not protect FFGym Licence and does not replace two-factor authentication or account management in federation tools. It can help a club manage unique passwords and share authorised access without multiplying copies in documents or messages.
Takeaway
The FFGym case shows how a compromised club account can open access to a federation tool and licence-holder data. The other sports incidents cited here are separate, but underline the value of individual accounts, stronger authentication and phishing awareness. Read the first steps after a data breach and use the team password-sharing guide to formalise access in your club.
