French Pass Sport

A data exfiltration incident at France's Ministry of Sports, Youth and Community Life exposed personal data tied to the Pass'Sport program, a government subsidy that helps young people pay sports club fees. According to our investigation team, the breach contains 6,368,875 rows, with an estimated attack date of December 17, 2025. The incident drew national attention after a large data file appeared on a criminal forum, and the ministry later confirmed the data came from its own systems rather than from the CAF family benefits agency, which was initially blamed.

Breach Timeline

Night of December 17 to 18, 2025: A file of more than 22 million rows, about 15 GB, was published on a criminal forum. According to Les Numériques, the file initially appeared to come from the CAF, which denied any breach of its own systems.

December 18, 2025: The Ministry of Sports detected the security incident. In an official notice on sports.gouv.fr, the ministry said it mobilized technical teams to assess the scope of the data involved and stop the leak.

December 2025: The ministry confirmed the exfiltration compromised personal data of about 3.5 million households and said a criminal complaint would be filed and the CNIL data protection authority notified within 72 hours, per RTL.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses.

The Pass'Sport program collected data through the ministry from the CAF, the MSA (the agricultural social security body), and the Crous student services network, according to the ministry's notice published on the program's help pages. Cybersecurity researcher Baptiste Robert, speaking on RTL after reviewing the leaked file, reported seeing civil status records including first names, last names, dates of birth, email addresses, phone numbers, and CAF beneficiary numbers. The ministry said passwords and banking details were not exposed.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The exposed records combine full identity details with contact information and, in some cases, benefit-related identifiers. That combination is well suited to targeted phishing: someone who knows a family's name, email, and benefit number can craft convincing messages that appear to come from the government, the CAF, or a sports club, for example asking recipients to "revalidate" their Pass'Sport voucher or confirm bank details. Because the dataset includes children's and parents' details together, scammers can address families directly. Stolen identities can also be used for impersonation attempts by phone or email, and beneficiaries should expect that the data will remain available to fraudsters.

What Is French Pass Sport Doing in Response?

The ministry stated that its specialized technical teams were mobilized as soon as the incident was detected to verify the nature and scope of the affected data and to implement security measures to stop the leak. It committed to filing a criminal complaint with the competent authorities and notifying the CNIL within 72 hours, as required by regulation. The ministry also said it was working to inform the 3.5 million affected households and to share security recommendations with them. A notice posted on the Pass'Sport help pages confirmed the unauthorized access and said it affected personal data collected from the CAF, MSA, and Crous network.

What Should You Do If You Were Affected?

Be skeptical of unexpected emails, texts, or calls that reference the Pass'Sport, your benefits, or a sports club registration, especially if they ask you to click a link, confirm bank details, or reset a password.

Never provide banking information or passwords in response to a message about your Pass'Sport voucher. Official voucher communication comes through the government site pass.sports.gouv.fr.

Change passwords on accounts that use the same credentials as any account tied to this program, and enable two-factor authentication where it is offered.

If you receive a phishing attempt, report it. In France you can forward suspicious emails or texts to cybermalveillance or report them on the signal.conso site.

Watch for notifications from the ministry or the Pass'Sport program. The ministry has said affected people will be informed "as soon as possible."