Pass'Sport Program Data Breach Exposes Over 6.3 Million French Citizens
What Happened
In December 2025, a dataset from France’s Pass’Sport program was posted on a public hacking forum. The leak contains 6,366,133 records – roughly 3.5 million households – with email addresses, names, phone numbers, genders and physical addresses. The Ministry of Sports confirmed the breach after it was initially mis‑attributed to another agency.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over citizen‑data platforms, ensuring that access controls and encryption are verifiable at audit time.
- Highlights the importance of maintaining up‑to‑date vendor and third‑party risk registers, as the breach originated from a government‑run service.
- Reinforces the requirement to document incident‑response evidence (log collection, forensic analysis) to satisfy regulatory bodies such as CNIL and GDPR.
Who Is Affected
- Government and public‑sector agencies handling citizen identity data.
- Sports administration and related service providers.
- Any organization that ingests or shares Pass’Sport data (e.g., local municipalities, health‑related programs).
Recommended Actions
- Review all integrations with the Pass’Sport API or data feeds for unnecessary exposure.
- Validate that monitoring controls (e.g., SIEM alerts for anomalous data extraction) were active and retained logs for the incident window.
- Request a detailed incident‑response report from the Ministry of Sports and update your own breach‑notification procedures accordingly.
Technical Notes
- Attack vector: Unauthorized access to the Pass’Sport database, likely via compromised credentials or insufficient segmentation.
- CVEs: None disclosed.
- Data types exposed: Email addresses, full names, phone numbers, gender, physical mailing addresses.
Source: https://haveibeenpwned.com/api/v3/breach/PassSport