French Pass’Sport Data Breach Exposes 6.5 Million Parents’ Personal Information
In a major privacy violation, the personal data of 6.5 million parents who registered for France’s Pass’Sport program designed to help children access sports activities was breached and posted on a hacking forum last month. The exposed records included names, phone numbers, physical addresses, and gender, with 71% of the email addresses already compromised in prior breaches, such as those involving LinkedIn.
The incident highlights a growing risk in government-run digital services, where sensitive citizen data is entrusted to platforms with inadequate security measures. While the breach was confirmed by cybersecurity tracking services like Have I Been Pwned, the full extent of the damage remains unclear, including whether financial or additional sensitive details were exposed.
The leak underscores the persistent threat of credential reuse, as a significant portion of the data had already been circulating in underground markets. French authorities have yet to issue a detailed response, but the breach serves as a stark reminder of the vulnerabilities in public-sector data handling.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7418691442304389120
Association Pass-Sport cybersecurity rating report: https://www.rankiteo.com/company/association-pass-sport
"id": "ASS1768758350",
"linkid": "association-pass-sport",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '6.5 million parents',
'industry': 'Public Sector',
'location': 'France',
'name': 'Pass’Sport (French government program)',
'type': 'Government Program'}],
'data_breach': {'data_exfiltration': 'Posted on a hacking forum',
'number_of_records_exposed': '6.5 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information)',
'type_of_data_compromised': ['Names',
'Phone numbers',
'Physical addresses',
'Gender',
'Email addresses']},
'description': 'In a major privacy violation, the personal data of 6.5 '
'million parents who registered for France’s Pass’Sport '
'program designed to help children access sports activities '
'was breached and posted on a hacking forum last month. The '
'exposed records included names, phone numbers, physical '
'addresses, and gender, with 71% of the email addresses '
'already compromised in prior breaches, such as those '
'involving LinkedIn. The incident highlights a growing risk in '
'government-run digital services, where sensitive citizen data '
'is entrusted to platforms with inadequate security measures.',
'impact': {'brand_reputation_impact': 'Stark reminder of vulnerabilities in '
'public-sector data handling',
'data_compromised': 'Personal information (names, phone numbers, '
'physical addresses, gender, email addresses)',
'identity_theft_risk': 'High (due to exposure of personal '
'information)'},
'lessons_learned': 'Persistent threat of credential reuse and vulnerabilities '
'in public-sector data handling',
'post_incident_analysis': {'root_causes': 'Inadequate security measures in '
'government-run digital services'},
'references': [{'source': 'Have I Been Pwned'}],
'title': 'French Pass’Sport Data Breach Exposes 6.5 Million Parents’ Personal '
'Information',
'type': 'Data Breach'}