InfoSecBulletin Cybersecurity for mankind
The French Football Federation (FFF) has reported a major cybersecurity breach that led to the theft of personal data from members and licensees. The federation announced that hackers had breached the centralized software used by football clubs to handle memberships and daily tasks. The breach happened not because of software flaws, but due to unauthorized access from a compromised user account.
The compromised credential gave attackers admin access, enabling them to move through the system and steal sensitive databases before they were stopped.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The disclosure reads, “The FFF reports that the software used by clubs for their administrative management, and in particular that of their members, has been the victim of a cyberattack and data theft.
Upon detection of this unauthorized access through the use of a compromised account, the FFF services took the necessary steps to secure the software and data, including immediately disabling the account in question and resetting all user account passwords.
A complaint has been filed and the relevant authorities (ANSSI, CNIL) have been informed of this attack. Furthermore, the FFF will send a communication to the individuals whose email addresses were listed in the database.
This breach is limited to the following data only: name, surname, gender, date and place of birth, nationality, postal address, email address, telephone number and license number.
The FFF is committed to protecting all the data entrusted to it and is constantly strengthening and adapting its security measures in order to cope, like many other actors, with the increasing number and new forms of cyberattacks.
We recommend that you exercise the utmost vigilance regarding any suspicious or unusual communications you may receive (SMS, call, email, etc.) that appear to originate from the FFF, your Club or another sender (for example, inviting you to open an attachment or to provide your account details and passwords or banking information).”
