French rugby club Stade Français Paris has confirmed it was the target of a cyberattack that disrupted a portion of its information systems. The club announced Thursday that it has successfully restored its IT environment using clean backups, allowing normal operations to resume. Its ticketing platform and online store were unaffected and remain fully functional.
Stade Français acknowledged that a sample of data, purportedly stolen during the incident, has been published online. The club is actively investigating the scope of the breach to identify any individuals whose information may have been compromised. To safeguard its interests and avoid hindering the ongoing investigation, the club stated it would not comment on communications from the attackers or information circulated by third parties.
Upon discovering the incident, Stade Français notified relevant authorities and filed a criminal complaint. The club did not attribute the attack to any specific threat actor, nor did it disclose whether a ransom demand was received or if negotiations were underway.
Earlier this week, the Qilin ransomware group claimed responsibility for the attack on its darknet leak site. Reports from French media indicate that the attackers published documents belonging to 18 players as proof of the breach, threatening to release additional files if a ransom is not paid by the end of next week. The authenticity of these leaked documents has not been independently verified.
Qilin operates as a ransomware-as-a-service (RaaS) operation, providing its malware to affiliates who conduct attacks in exchange for a share of ransom payments. The group typically employs double extortion tactics, exfiltrating data before encrypting victim systems and threatening to publish the stolen information if payment is not made. Cybersecurity researchers have previously linked Qilin to Russian-speaking cybercriminals.
Sports organizations have increasingly become targets for financially motivated cybercriminals. Earlier this year, Dutch soccer club Ajax disclosed that an unpatched vulnerability led to unauthorized access to internal systems, exposing email addresses of several hundred individuals and limited personal data related to those subject to stadium bans. In 2024, Italian soccer club Bologna FC also experienced a ransomware attack that compromised financial documents, player medical records, and confidential employee information.
Other recent victims in the sports sector include Paris Saint-Germain football club, which reported a cyberattack targeting its online ticketing service in 2024; Manchester United, which suffered a ransomware incident in 2020; the Royal Dutch Football Association in 2023; and the French Football Federation in 2025.
