Threat watch / Breach
French Shooting Federation (FFTir): second intrusion in a year, 64,000 ID photos copied
On October 12, someone logged into the FFTir licensee area with a licensee's stolen or guessed credentials and copied about 64,000 ID photos and nearly 19,000 documents. The federation told licensees on October 22. It says no information on weapon ownership was touched.
- Sector
- Associations & sport
- Way in
- Stolen credentials
- Product or vendor
- None named
- How it happened
- A login on October 12 to EDEN, the licensee area, with a licensee's credentials "stolen or guessed", according to the federation's letter as reported by Next. A licence-check function of Cibles Couleurs, the training site, was also queried in bulk. Two-factor authentication existed on EDEN but was still optional, according to IT-Connect.[1][2] Checked 8 Nov 2026
- What was stolen
- About 64,000 ID photos, nearly 19,000 documents (including aptitude certificates) and the full files of 55 licensees; plus name, first name, club, age category and Cibles Couleurs grade for most current and former licensees. The federation says passwords, bank details and weapon ownership data were not taken.[1][2][3] Checked 8 Nov 2026
- Who was impacted
- Most current and former licensees, according to the federation, which gives no total. A seller on a forum claims data on 586,854 people; the federation does not confirm that figure.[1][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Login to EDEN with a licensee's credentials. The access is blocked that evening, according to ZATAZ. [2][3]
- The federation informs ANSSI on October 13 and 15, and the CNIL on October 16, according to its president Hugues Senger, quoted by Next. [2]
- The Cibles Couleurs function is closed and fixed; access to EDEN documents is cut on October 16. [2]
- A seller using the handle ChimeraZ lists a 40 GB archive said to come from the FFTir, according to ZATAZ. This is the seller's claim. [3]
- The federation tells licensees. It warns that police, gendarmerie and customs never call or come to collect weapons. Senger: "Aucune information sur la possession d'armes n'a été touchée." [1][2][4]