Olympique de Marseille: Olympique Marseille confirms 'attempted' cyberattack after data leak

Olympique de Marseille Confirms Cyberattack After Threat Actor Claims Data Breach

French football giant Olympique de Marseille (OM) has acknowledged a cyberattack after a threat actor claimed to have breached the club’s systems earlier this month. The 126-year-old club, a historic Ligue 1 side and the first French winner of the UEFA Champions League in 1993, confirmed the incident in a statement on Tuesday.

The threat actor, who posted on a hacking forum, alleged they stole a database containing personal information on 400,000 individuals, including staff and supporters. The leaked sample reportedly includes names, addresses, order details, email addresses, and phone numbers. Additionally, the attacker claimed to have accessed 2,050 Drupal CMS accounts, with 34 linked to OM staff and 1,770 to contributors and moderators.

In its official response, Olympique de Marseille stated that its technical teams and external experts swiftly contained the attack, ensuring operations continued securely. The club reassured fans that no banking details or passwords were compromised but has since reported the incident to France’s data protection authority (CNIL) and filed a formal complaint. While investigations into the breach’s full scope are ongoing, the club advised supporters to watch for potential phishing attempts.

The threat actor, who listed the stolen data for sale, claimed the breach occurred in February 2026 though this timeline remains unverified. As of now, OM has not provided further details on the attack’s origin or the extent of the exposed data.

Source: https://www.bleepingcomputer.com/news/security/olympique-marseille-football-club-confirms-cyberattack-after-data-leak/

Olympique de Marseille cybersecurity rating report: https://www.rankiteo.com/company/sasp-olympique-de-marseille

"id": "SAS1772123354",
"linkid": "sasp-olympique-de-marseille",
"type": "Breach",
"date": "2/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '400,000 individuals (staff and '
                                              'supporters)',
                        'industry': 'Sports',
                        'location': 'France',
                        'name': 'Olympique de Marseille',
                        'type': 'Football Club'}],
 'customer_advisories': 'Advisory to supporters on potential phishing attempts',
 'data_breach': {'data_exfiltration': 'Yes (claimed by threat actor)',
                 'number_of_records_exposed': '400,000 individuals, 2,050 '
                                              'Drupal CMS accounts',
                 'personally_identifiable_information': 'Names, addresses, '
                                                        'order details, email '
                                                        'addresses, phone '
                                                        'numbers',
                 'sensitivity_of_data': 'High (PII, but no banking details or '
                                        'passwords)',
                 'type_of_data_compromised': 'Personal information, CMS '
                                             'account details'},
 'date_detected': '2026-02',
 'description': 'French football club Olympique de Marseille confirmed a '
                'cyberattack after a threat actor claimed to have breached the '
                'club’s systems and stolen a database containing personal '
                'information on 400,000 individuals, including staff and '
                'supporters. The leaked data reportedly includes names, '
                'addresses, order details, email addresses, and phone numbers. '
                'The attacker also claimed access to 2,050 Drupal CMS '
                'accounts.',
 'impact': {'data_compromised': 'Personal information (names, addresses, order '
                                'details, email addresses, phone numbers), '
                                'Drupal CMS accounts',
            'identity_theft_risk': 'Potential phishing attempts',
            'operational_impact': 'Contained; operations continued securely',
            'payment_information_risk': 'None (no banking details or passwords '
                                        'compromised)',
            'systems_affected': 'Drupal CMS'},
 'initial_access_broker': {'data_sold_on_dark_web': 'Yes (listed for sale)'},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial Gain',
 'references': [{'source': 'Hacking forum post by threat actor'}],
 'regulatory_compliance': {'legal_actions': 'Reported to CNIL (France’s data '
                                            'protection authority)',
                           'regulations_violated': 'Potential GDPR violation',
                           'regulatory_notifications': 'Yes'},
 'response': {'communication_strategy': 'Official statement to fans, advisory '
                                        'on phishing attempts',
              'containment_measures': 'Swift containment by technical teams '
                                      'and external experts',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Formal complaint filed',
              'third_party_assistance': 'External experts'},
 'stakeholder_advisories': 'Advisory to fans on potential phishing attempts',
 'title': 'Olympique de Marseille Cyberattack and Data Breach',
 'type': 'Data Breach'}