Pass'Sport pass.sports.gouv.fr Pass'Sport data breach: what happened and what to do
In December 2025, data from France's Pass'Sport sports-aid program leaked, covering about 3.5 million households and over 6 million email addresses, with names, phone numbers, genders and addresses. France's Ministry of Sports confirmed the incident.
View all 13,115 breaches- Breach date
- 17 Dec 2025
- Affected
- 6,366,133
- Data exposed
- Email addresses, Genders, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Pass'Sport is a French government program that helps families pay for children's sports club memberships. In December 2025, data from the program was posted to a hacking forum. At first it was blamed on CAF, the French family allowance fund, but the data came from the Ministry of Sports' own systems.
Have I Been Pwned (HIBP) dates the incident to 17 December 2025 and added it on 18 January 2026. The data covered about 3.5 million households and 6,366,133 email addresses. A household can have several addresses, which is why the two numbers differ.
The Ministry of Sports published a statement on sports.gouv.fr acknowledging a data exfiltration from one of its information systems. French coverage, including Le Monde Informatique, reported that the ministry said it would contact the households concerned, file a complaint and notify the data protection regulator CNIL.
What was exposed
HIBP lists these data types:
- Email addresses
- Names
- Phone numbers
- Physical addresses
- Genders
The list reaches families because the program is about children. A record can tie a parent's name, phone number and home address to the family's sports club activity. Passwords and payment details are not listed in HIBP's entry.
What this lets criminals do
Names, a home address and a phone number are all a scammer needs to sound legitimate. Messages that mention Pass'Sport, a sports club, a refund, or the Ministry of Sports will look real because they match something you did. Expect:
- Emails or texts claiming you are owed money or must "update your Pass'Sport file"
- Calls from someone posing as a government agency or your bank
- Targeted scams that use your address to seem local
Home addresses also make it easier to build a profile of a family: where you live, who is in your household, and roughly how old the children are. That is a reason to be careful about unexpected contact that refers to your children.
The response
The ministry acknowledged the incident, said it was working to inform the households involved and to send them security advice, and said it would notify CNIL within the 72 hours the regulation requires. If you are a French resident who used Pass'Sport, watch for an official email from the ministry and check the ministry's website directly rather than following links in messages.
What stays out of reach
Once data is on a hacking forum, it can't be pulled back. You can't undo the exposure of your address or phone number, but you can make the information less useful. Be wary of anything that mentions the program, never give a code or password over the phone, and verify claims by contacting the ministry through its official site.
What to do if you were in it
- 1
Treat anything that mentions Pass'Sport as suspect
Scammers know you used the program. Don't click links or call numbers in messages about refunds or account updates. Go to the ministry's official site yourself.
- 2
Never share codes or passwords on a call or text
A real agency or bank won't ask for a one-time code or your password. Hang up and call back using a number you looked up.
- 3
Watch for the ministry's official notice
The ministry said it would inform the households involved. Compare any message with what is published on sports.gouv.fr before you act on it.
- 4
Warn the family
Tell partners and older children that messages mentioning sports clubs or the program may be scams, since names and addresses of the whole household can be targeted.
- 5
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 6
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Pass'Sport breach?
Search your email on Have I Been Pwned. If Pass'Sport is listed, your email and related details were in the data. The ministry also said it would contact affected households.
What was exposed?
Email addresses, names, phone numbers, genders and physical addresses, according to Have I Been Pwned.
Was the CAF hacked?
The data was first attributed to CAF, but it came from the Ministry of Sports. HIBP notes the initial attribution was wrong.
Should I change my password?
HIBP doesn't list passwords in this breach. Be careful with phishing instead, and change the password on any account where you shared it by mistake.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
