Incident Overview

HexDex, a prolific threat actor previously responsible for the Therapeutes, Airsoft-Entrepot, and Allopneus breaches targeting French organizations, is now selling the personal data of 1,926,409 members and approximately 800,000 parents from the Federation Francaise de Basket-Ball (FFBB), the governing body for basketball in France. The total dataset covers roughly 2.7 million individuals and includes a 5,000-line sample distributed across six file hosting services.

The dataset statistics show significant deduplicated contact volumes: 1,444,527 unique member emails, 1,513,270 unique member phones, 468,306 unique landlines, 511,120 unique mother phone numbers, 538,890 unique mother emails, 271,121 unique father phone numbers, and 91,955 unique father emails. Each member record contains an extensive set of fields:

• Personal Identity: Full names, first names, dates of birth, place of birth, gender, and nationality.
• Contact and Address: Personal phone numbers, home/landline numbers, email addresses, full street addresses with complement details (apartment floor, building), postal codes, and commune names.
• Federation Data: Licence numbers, qualification dates, player category codes (U19, U20, Senior), league/division classifications, regional league identifiers (IDF, ARA, BRE, CVL), and club affiliations with organization names and codes.
• Medical Information: Medical certificate dates and medical certificate expiration dates, which confirm whether a player has a current health clearance to compete.
• Physical Data: Height measurements in meters for individual players.
• Club and Organization: Club SIRET numbers (French business registration), club organization codes, prefecture registration numbers, and club names.
• Consent and Authorization: FFBB offer authorization status, partner authorization status, and engagement charter flags.
• Parent Data: For minor players, the dataset includes mother and father email addresses, phone numbers, and contact details as separate fields.

The child safety dimension of this breach is critical. The sample data shows records for individuals born in 2003, 2004, 2005, and 2007, many in the U19 and U20 categories. For these minor and recently-adult players, the database exposes not only their personal information but also their parents' contact details, their home addresses, their club locations, and their physical height. The medical certificate data adds a health information dimension that may trigger additional GDPR and French health data protection requirements.