/ 
On February 5, 2026, the Fédération Française de Voile announced a security incident affecting its license management platform. The incident involved the fraudulent use of a compromised club account, enabling the extraction of personal data from a large number of licensees. At this stage, the federation indicates that no direct intrusion of its IT system has been observed.
Fraudulent use of a club account
According to the information provided by FFVoile, the leak was not the result of hacking into the central infrastructure, nor of a failure of the global authentication mechanisms. The unauthorized access was made possible by the compromise of a club account, used fraudulently.
Using a mechanism described as complex, this account made it possible to extract personal data concerning several hundred thousand licensees. Investigations are continuing to determine the exact extent of access to the information.
What data is involved?
The data consulted and extracted concerns exclusively identification and contact information. This includes first and last name, date of birth, gender, postal address, e-mail address and telephone number.
The indication of a handicap, when provided, is also part of the data concerned. The FFVoile specifies that no detailed medical, banking or password-related data has been compromised.
What are the risks for licensees?
At this stage, the federation is not in a position to confirm that the data will be made public. Nevertheless, their compromise exposes those concerned to several risks.
Phishing attempts can occur, in the form of emails, SMS messages or calls pretending to be from the FFVoile, a club or a partner. Spam and unwanted commercial solicitations are also possible consequences. Finally, targeted phishing becomes more credible when fraudsters have precise personal information at their disposal.
Recommendations for practitioners and clubs
The FFVoile calls on its members to be vigilant in the face of attempted fraud. They are reminded never to transmit passwords, bank details or sensitive information by e-mail, telephone or SMS.
It is advisable to systematically check the sender of messages received, not to click on unexpected links or attachments, and to contact the organization concerned directly in case of doubt. The federation also recommends using strong, unique passwords, enabling two-factor authentication where possible, and using a password manager.
A dedicated contact has been set up, via the Data Protection Officer, who can be reached at dpo@ffvoile.fr, to answer any questions relating to this incident.
