--- title: "French Ministry of Sports Pass'Sport data exfiltration" description: "Evidence-backed account of French Ministry of Sports Pass'Sport data exfiltration, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/french-ministry-sports-passsport-data-exfiltration-2025" markdown_url: "https://www.ally.security/incidents/french-ministry-sports-passsport-data-exfiltration-2025.md" stix_url: "https://www.ally.security/incidents/french-ministry-sports-passsport-data-exfiltration-2025/stix.json" --- # French Ministry of Sports Pass'Sport data exfiltration An exfiltration from a French Ministry of Sports information system associated with the Pass'Sport program and a later-public personal-data corpus. A public corpus measured separately as unique email addresses, historical rows, and affected households so those units are not conflated. Last modified Aug 9, 2026 · 4 sources ## Summary - **Environment:** Pass'Sport - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened An exfiltration from a [French Ministry of Sports](https://www.sports.gouv.fr/) information system associated with the Pass'Sport program and a later-public personal-data corpus. [1](#source-1) [3](#source-3) ## Impact A public corpus measured separately as unique email addresses, historical rows, and affected households so those units are not conflated. [1](#source-1) [3](#source-3) Documented data types include: - Contact information — Email addresses, phone numbers, and physical or postal addresses associated with corpus records. [1](#source-1) [3](#source-3) - Gender information — Gender information listed in HIBP's verified Pass'Sport record. [1](#source-1) [3](#source-3) - Names — Names listed by HIBP and identities directly reported in the examined corpus. [1](#source-1) [3](#source-3) A cited record reports 6,366,133 records (Unique email addresses represented in the verified HIBP corpus; not a count of unique people, households, total rows, or Pass'Sport beneficiaries; as of 2026-01-18). [1](#source-1) [3](#source-3) A cited record reports 22,445,764 records (Rows in the file directly examined by Les Numériques; the publication said the four-year history could contain the same person up to four times, so this is not a people or household count). [3](#source-3) The ministry said specialized technical teams assessed the nature and scope of the affected data and implemented security measures to stop further leakage. [2](#source-2) A file associated with the incident was published on a criminal forum during the night of December 17 to 18, 2025. [1](#source-1) [3](#source-3) The ministry said it was working to inform 3.5 million affected households, while independent analysis described approximately 3.5 million unique households after deduplication. [1](#source-1) [2](#source-2) [3](#source-3) CNAF said the circulated data appeared to come from another public service's information system with which it exchanged data for benefits or services. [4](#source-4) ## Timeline ### December 17, 2025 — Documented event HIBP BreachDate and the beginning of the reported night-of-December-17-to-18 corpus publication window; not established as the initial-access, exfiltration, detection, or containment date. [1](#source-1) [3](#source-3) ### December 19, 2025 — Public disclosure Date of the ministry's public exfiltration notice; public reporting and CNAF's statement appeared the preceding day. [2](#source-2) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The incident involved Pass'Sport. HIBP identifies the corpus as Pass'Sport data, and independent analysis linked the mixed CAF, MSA, and CNOUS fields plus id\_psp identifiers to that program; the ministry notice did not name a specific application. [1](#source-1) [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response CNAF said the disclosed data did not include banking data or passwords capable of accessing caf.fr accounts. CNAF said its investigation detected no intrusion or vulnerability in its own information systems or caf.fr. The ministry said it would notify CNIL within 72 hours in accordance with its regulatory obligations. The ministry said it would file a complaint with the competent authorities. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [2](#source-2) [4](#source-4) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Pass'Sport breach record advisory · Have I Been Pwned · Jan 18, 2026 ### Exfiltration de données provenant d’un des systèmes d’information du ministère official · Ministère des Sports, de la Jeunesse et de la Vie associative · Dec 19, 2025 ### Fuite de données CAF : Pass'Sport identifié, 3,5 millions de foyers exposés research · Les Numériques · Dec 18, 2025 ### Cyberattaque : la Cnaf confirme la sécurité de son système d’information official · Caisse nationale des Allocations familiales · Dec 18, 2025
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: The ministry said specialized technical teams assessed the nature and scope of the affected data and implemented security measures to stop further leakage. 2. **Located In · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: France 3. **Affected Organization · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: Ministère des Sports, de la Jeunesse et de la Vie associative 4. **Resulted In · 95% confidence · current** December 2025 French Ministry of Sports data exfiltration: Pass'Sport personal-data corpus 5. **Resulted In · 95% confidence · current** Pass'Sport personal-data corpus: A file associated with the incident was published on a criminal forum during the night of December 17 to 18, 2025. 6. **Resulted In · 100% confidence · current** Pass'Sport personal-data corpus: The ministry said it was working to inform 3.5 million affected households, while independent analysis described approximately 3.5 million unique households after deduplication. 7. **Exposed Record Count · 100% confidence · current** Pass'Sport personal-data corpus: 6,366,133 record 8. **Resulted In · 95% confidence · current** December 2025 French Ministry of Sports data exfiltration: CNAF said the circulated data appeared to come from another public service's information system with which it exchanged data for benefits or services. 9. **Exposed Data Category · 100% confidence · current** Pass'Sport personal-data corpus: Contact information 10. **Used Product · 95% confidence · current** December 2025 French Ministry of Sports data exfiltration: Pass'Sport 11. **Exposed Record Count · 90% confidence · current** Pass'Sport personal-data corpus: 22,445,764 record 12. **Exposed Data Category · 100% confidence · current** Pass'Sport personal-data corpus: Gender information 13. **Resulted In · 100% confidence · current** Pass'Sport personal-data corpus: CNAF said the disclosed data did not include banking data or passwords capable of accessing caf.fr accounts. 14. **Resulted In · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: CNAF said its investigation detected no intrusion or vulnerability in its own information systems or caf.fr. 15. **Occurred At · 85% confidence · current** December 2025 French Ministry of Sports data exfiltration: 2025-12-17 16. **Disclosed At · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: 2025-12-19 17. **Resulted In · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: The ministry said it would notify CNIL within 72 hours in accordance with its regulatory obligations. 18. **Exposed Data Category · 100% confidence · current** Pass'Sport personal-data corpus: Names 19. **Resulted In · 100% confidence · current** December 2025 French Ministry of Sports data exfiltration: The ministry said it would file a complaint with the competent authorities.