Pass'Sport Data Breach (2025): What Was Exposed & What To Do

In December 2025, data associated with France’s Pass’Sport program appeared on a popular hacking forum. The incident was reported on December 17 and involved records linked to 6.4 million people. The Ministry of Sports later issued a statement confirming the exposure after the data had first been attributed to the French family-allowance fund, CAF. The records contained 6.5 million unique email addresses tied to 3.5 million households, along with names, phone numbers, genders and physical addresses.

Breaking down the breach

The data set was posted publicly in mid-December 2025. No official statement has disclosed the exact date or method of the initial intrusion. The Ministry of Sports acknowledged the incident after the forum post surfaced, correcting the earlier misattribution to CAF. Public records do not yet specify the volume of records accessed, the duration of any unauthorised access, or whether additional data sets were involved.

How a breach like this happens

Incidents involving large administrative or subsidy programmes often begin with the compromise of an internet-facing server, a misconfigured database, or stolen administrative credentials. Once access is obtained, attackers can copy tables containing user records and later post samples or full archives on forums to demonstrate the material or seek payment. The precise vector in any single case remains unknown until investigators publish findings.

Pass'Sport and its sector

Pass’Sport is a French government initiative administered under the Ministry of Sports that provides financial support for young people’s participation in organised physical activity. Programmes of this type collect personal details to verify eligibility, process applications and distribute funds or vouchers. The data typically include contact information and household identifiers needed to administer benefits at national scale.

What was likely exposed

The published records list email addresses, names, phone numbers, genders and physical addresses. No further categories have been confirmed by official sources. Organisations managing sports-subsidy programmes routinely hold additional fields such as dates of birth, national identification numbers or bank details for payment processing; whether those fields appear in the posted data remains unconfirmed.

What's at stake

Exposed email addresses and phone numbers can be used for targeted phishing or unsolicited contact. Physical addresses combined with names increase the risk of more personalised social-engineering attempts. For the organisation, the incident raises questions about data-handling practices and may prompt regulatory review by French data-protection authorities. Affected individuals face no immediate financial loss from the listed fields alone, but the combination of contact and location data warrants continued vigilance.

What to do if you're exposed

Review any recent unsolicited messages that reference Pass’Sport or sports-subsidy programmes and avoid clicking links or providing further information. Enable two-factor authentication on email and other accounts that use the exposed address. Monitor bank and official correspondence for unusual activity. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in this or other public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.