www.it-connect.fr
French Shooting Federation Hacked Again: IDs and Certificates Exposed
About 64,000 ID photos and nearly 19,000 documents uploaded by shooters: that is part of what an attacker managed to retrieve from the servers of the French Shooting Federation (FFTir). One year after a first data leak, the federation has been hit again. Here is what we know about the incident.
On October 22, 2026, FFTir warned its license holders and published a communication relative to a cyberattack. It describes an attack presented as planned, carried out during the week of October 12 against two services: EDEN, the portal where shooters manage their license, and Cibles Couleurs, the training site.
As a reminder, the federation had already been targeted in October 2025: ITAC, the clubs' intranet, had exposed the license number, civil status, postal address, email address, and phone number of license holders. This time, two other services were targeted, but they are still tied to FFTir. For license holders, this is starting to be a lot with two data leaks in one year....
License Holder Accounts as the Entry Point
This attack is completely ordinary in terms of its method, since the attacker logged in to EDEN with license holder accounts, using stolen (or guessed) credentials. The attacker then managed to access information from other members, while massively querying the license verification tool on Cibles Couleurs.
Here are the affected data, according to the French Shooting Federation:
- Identity and activity: for most license holders, current and former, last name, first name, club, age category, and Cibles Couleurs grade.
- ID photos: about 64,000 files.
- Uploaded documents: nearly 19,000 files, including certificates of fitness for sporting shooting.
- Complete records: 55 license holders, contacted individually, who were even more affected than the others.
"No information regarding gun ownership was affected.", says FFTir, which does not hold that data. But generally, if you are registered with a shooting club, there is a good chance you own at least one.... Also regarding this incident, passwords and banking data do not appear to have been affected either.
What I do not understand when reading FFTir's statement is how the attacker went from compromised accounts to the data of thousands of accounts. There must have been accounts with high privileges in the mix. In any case, this scenario suggests an access control flaw, and the mass querying suggests that the number of requests was not rate-limited (as is often the case).
Two-Factor Authentication Still Optional on EDEN
The starting point is valid credentials, which raises the usual question: was two-factor authentication enabled? In this case, two-factor authentication has been available on EDEN for several months without being mandatory, unlike ITAC. "Two-factor authentication is being rolled out gradually across our tools", writes Hugues Senger, who also mentions a complete overhaul of the applications, soon to be deployed. One year after the first attack, the project is therefore still not finished.
According to FFTir, the attacker then moved to public extortion, by putting a sample of the data freely available. Then the attacker came back at Cibles Couleurs, this time to try to take over accounts. FFTir shut down the site that evening: it will remain offline until its full security has been verified. On EDEN, tens of thousands of attempts were blocked during that same weekend. A sign that the attacker is still active.
The bottom line: if you are a license holder, the main risk now is social engineering. FFTir reminds users that law enforcement will never call you, and will never show up unannounced at your home, to collect your firearms following this leak.
