Champions Cup rugby team hacked in ransom attack with player data at risk
Champions Cup rugby club Stade Francais has said it is the victim of a cyber attack, with reports stating players’ identity documents are being held to ransom.
Cybercriminals have reportedly threatened to release documents relating to players, having already unveiled a number of identifiable documents belonging to 18 players.
“Immediate containment, investigation and recovery measures have been implemented to secure the affected systems and ensure business continuity,” the French rugby club said in a statement.
Stade Francais – the Parisian Top 14 club that will take on the Vodacom Bulls, Northampton Saints, Bath Rugby and Cardiff Rugby in this year’s Investec Champions Cup – is coached in part by former Harlequins boss Paul Gustard and last year featured the likes of England centre Joe Marchant, who has returned to the Prem ahead of the coming season.
Some reports have alleged the actor to be Qilin, a Russian-speaking ransomware group. It has traditionally wanted high payments as ransoms and reportedly hacked NHS medical services provider Synnovis in 2024.
Stade Francais hacked
Online ticketing sales, wider club shop sales and merchandise websites aren’t affected.
It is the latest cyber attack on sport following major breaches and attempted hacks coming across the last decade. In 2021 NBA’s Houston Rockets received the threat of a mass data leak, while football club Ajax saw web vulnerabilities exposed by cybercriminals earlier this year.
The Olympic Games have also been targeted, in both 2018 and 2026, while the French Rugby Federation was the victim of an operational lockdown due to ransomware.
Industry reports in 2023 suggested that Stade Francais, one of two Parisian Top 14 clubs, had inadvertently leaked its server source code, exposing information publicly to actors who could have made system changes within the club’s website.
Stade Francais have filed a complaint with the relevant authorities ahead of the return of the Top 14 in September, with Stade Francais hosting Perpignan.