Welsh Rugby Union (WRU)

A cybersecurity breach exposed the personal data of tens of thousands of Welsh Rugby Union (WRU) supporters' club members. According to reports, details of nearly 70,000 individuals including names, addresses, phone numbers, emails, and initially claimed payment information were leaked. The WRU acknowledged the breach but clarified that the 70,000 figure included duplicated records, reducing the actual number of affected individuals. While the organization denied that payment details were compromised, the exposure of sensitive personal data (names, contact details, etc.) poses significant risks, including potential identity theft, phishing attacks, or fraud targeting the affected supporters. The incident highlights vulnerabilities in the WRU’s data protection measures and raises concerns about the security of member information within sports organizations.

Source: https://www.bbc.co.uk/news/articles/c7224623j73o

TPRM report: https://www.rankiteo.com/company/wru

"id": "wru2254222102825",
"linkid": "wru",
"type": "Breach",
"date": "10/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Up to 70,000 (including '
                                              'duplicates; true number '
                                              'unspecified)',
                        'industry': 'Sports/Entertainment',
                        'location': 'Wales, United Kingdom',
                        'name': 'Welsh Rugby Union (WRU)',
                        'type': 'Sports Organization'}],
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 'Up to 70,000 (with duplicates; '
                                              'exact number unclear)',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High (includes names, addresses, '
                                        'phone numbers, emails)',
                 'type_of_data_compromised': ['personal identifiable '
                                              'information (PII)',
                                              'contact details']},
 'description': 'Data belonging to tens of thousands of Welsh Rugby Union '
                "(WRU) supporters' club members has been exposed in a "
                'cybersecurity breach. Details of almost 70,000 people were '
                'leaked, including names, addresses, phone numbers, emails, '
                'and allegedly payment details (though WRU denied payment '
                'information was compromised). WRU acknowledged the breach but '
                'stated the 70,000 figure includes duplicated data, reducing '
                'the true number of affected individuals.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'exposure of member data',
            'data_compromised': ['names',
                                 'addresses',
                                 'phone numbers',
                                 'emails'],
            'identity_theft_risk': 'High (personal details exposed)',
            'payment_information_risk': 'Denied by WRU (allegedly included in '
                                        'initial reports)'},
 'investigation_status': 'Acknowledged by WRU; details pending',
 'references': [{'source': 'Cybernews'}],
 'response': {'communication_strategy': 'Public acknowledgment of breach; '
                                        'denial of payment data compromise'},
 'title': "Welsh Rugby Union (WRU) Supporters' Club Data Breach",
 'type': 'Data Breach'}