Stade Francais hit by ransomware as player documents held hostage

Stade Francais has confirmed it is the victim of a ransomware attack that has already exposed identity documents belonging to 18 players, with the cybercriminals threatening to release more unless a payment is made. The Parisian club, which competes in the Investec Champions Cup this season, said immediate containment and recovery measures were under way and that its ticketing, merchandise and club shop platforms remain unaffected.

The breach is the latest in a string of high-profile cyber incidents targeting professional sport. In 2021 the NBA's Houston Rockets faced a mass data leak threat, while Ajax had web vulnerabilities exposed earlier this year. The Olympic Games were targeted in 2018 and again in 2024, and the French Rugby Federation suffered an operational lockdown from ransomware. Industry reports from 2023 also revealed that Stade Francais had inadvertently leaked its own server source code, potentially giving attackers a foothold.

Suspected Russian-speaking gang

Security researchers have pointed to Qilin, a Russian-speaking ransomware group known for demanding high payments. The group was linked to the 2024 breach of Synnovis, an NHS medical services provider, which caused widespread disruption to London hospitals. Qilin typically exfiltrates sensitive data before encrypting systems, using the threat of public release as leverage.

Immediate containment, investigation and recovery measures have been implemented to secure the affected systems and ensure business continuity.

The club said in a statement. It has filed a formal complaint with the relevant French authorities and is working with cybersecurity specialists to assess the full scope of the intrusion.

Season looms

Stade Francais, coached in part by former Harlequins boss Paul Gustard, is preparing for a Champions Cup pool that includes the Vodacom Bulls, Northampton Saints, Bath Rugby and Cardiff Rugby. The domestic Top 14 campaign resumes in September with a home fixture against Perpignan. England centre Joe Marchant, who featured for the club last season, has since returned to the Premiership.

For now, the club insists match-day operations and commercial platforms are running normally. But with player passports, contracts and medical records potentially in the hands of extortionists, the reputational and legal fallout could extend well beyond the opening whistle.