[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2n4j931frnbzq":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":7,"domain":9,"breachDate":10,"addedDate":11,"publishedAt":12,"modifiedDate":13,"contentUpdatedAt":14,"source":15,"sourceUrl":16,"sourceUrls":17,"pwnCount":18,"affectedCount":18,"affectedCountStatus":19,"affectedCountLowerBound":12,"affectedCountUnit":20,"hasEnglishDescription":4,"contentLocale":21,"availableLocales":22,"translations":24,"severity":27,"dataClasses":28,"description":34,"seoTitle":35,"seoDescription":36,"logoUrl":37,"isVerified":4,"isSensitive":38,"isSpamList":38,"isMalware":38,"company":39},"6a452308a20f867c8ba8e71f","passsport","Pass'Sport Data Breach","pass.sports.gouv.fr","2025-12-17T00:00:00.000Z","2026-01-18T16:26:12.000Z",null,"2026-07-03T09:47:07.210Z","2026-07-19T00:02:39.392Z","Third party breach","",[],6366133,"known","unknown","en",[21,23],"tr",{"en":25,"tr":26},{"slug":7},{"slug":7},"Critical",[29,30,31,32,33],"Email addresses","Genders","Names","Phone numbers","Physical addresses","\u003Cp>The Pass'Sport data breach was recorded in December 2025 with the exposure of household and user contact data belonging to France's sports support program. The dataset, which contained approximately 6.36 million unique email addresses, was associated with records affecting 3.5 million households. Since it includes names, phone numbers, gender information, and physical addresses, the incident poses a social engineering risk in the context of a public support program.\u003C\u002Fp> \u003Ch2>Leaked Data Types and Risks\u003C\u002Fh2> \u003Cp>The types of data listed in this record are the fields Email addresses, Genders, Names, Phone numbers, and Physical addresses. Password, payment card, or bank account fields are not listed. The main risk is the preparation of fake messages in the context of sports support, family assistance, public programs, child sports registration, or household information.\u003C\u002Fp> \u003Ch2>Public Sports Program and Household Effect\u003C\u002Fh2> \u003Cp>Since the Pass'Sport program may be associated with families, young people, sports clubs, and local institutions, the data should not be considered only as an individual user account. When address and phone information are available at the household level, attackers can prepare messages that appear to be related to family support, sports vouchers, registration renewal, document completion, or aid payment.\u003C\u002Fp> \u003Ch2>Fraud Through Address and Phone\u003C\u002Fh2> \u003Cp>Physical address and phone fields increase the risk of fraud via SMS, calls, and mail. The user may receive a message regarding support rights, sports club payment, registration correction, updating child information, or uploading a document. Even if the message contains the correct address or family context, if payment or identity information is requested, the official channel should be checked before taking any action.\u003C\u002Fp> \u003Cp>The gender field alone may not seem high-risk; however, when combined with name, address, phone number, and household context, it can help personalize messages. The program's nature as family and sports support may also raise processes related to children and youth. Therefore, families need to be cautious with unexpected sports club, registration, or support messages.\u003C\u002Fp> \u003Ch2>Verified Scope and Source Confusion\u003C\u002Fh2> \u003Cp>The fact that this record was initially attributed to another institution shows that data source confusion in public programs can mislead users. Users should clearly verify which institution the message came from, which program it is related to, and why they are requesting information. The use of the official institution name alone is not proof of reliability.\u003C\u002Fp> \u003Cp>From the perspective of institutions, the Pass'Sport incident demonstrates the importance of protecting household contact information in public support programs. When there is a flow of data between aid programs, sports clubs, local governments, and families, access permissions should be clear. Old records, unnecessary fields, and shared files should be regularly cleaned.\u003C\u002Fp> \u003Ch2>Necessary Precautions\u003C\u002Fh2> \u003Cp>Affected users should pay attention to messages related to sports support, family assistance, club registration, document uploading, payment, address verification, or phone confirmation coming under the name Pass'Sport. Communications requesting verification codes, bank information, identity documents, or payment should not be responded to without verification through official channels. Although the data fields do not contain passwords, the risk of social engineering is high due to the household and public program context.\u003C\u002Fp> \u003Ch2>Long-Term Family and Club Risk\u003C\u002Fh2> \u003Cp>Due to the family and household effect in Pass'Sport registration, users need to consider not only their own accounts but also sports records associated with their children or family members. Fraudsters may request additional information from the family under the pretext of support entitlement, club contribution, or document completion. Such requests should be verified separately through an official institution or club.\u003C\u002Fp> \u003Cp>In public support programs, users' trust is naturally higher. Messages using official logos, institution names, or program language may appear genuine. However, this violation shows that fields such as name, phone, and address can be used in fake official messages. Affected individuals should especially not respond to messages containing bank information, identification documents, or payment requests.\u003C\u002Fp> \u003Cp>For institutions, this event shows that public program data requires clear ownership and notification responsibility while circulating among different institutions. Users should be able to easily verify which institution they are communicating with.\u003C\u002Fp> \u003Cp>Therefore, families, sports clubs, and local institutions should verify every document request received through the official channel.\u003C\u002Fp> \u003Cp>Since records containing household data may touch on processes related to children and young people, extra caution is needed in these messages.\u003C\u002Fp>","Pass'Sport Data Breach (6.4 Million Reported Records)","Pass'Sport Data Breach. 6.4 Million reported records are reported. Reported data: Email addresses, Genders, Names. Review the scope, risks, and protective…","\u002Fuploads\u002Flogo\u002Fpass_sports_gouv_fr.webp",false,{"name":40,"sector":41,"country":42,"website":9,"websiteArchiveUrl":16,"websiteStatus":16,"websiteCheckedAt":12},"Pass'Sport","Government Program","France"]