Olympique Marseille confirms 'attempted' cyberattack after data leak

French professional football club Olympique de Marseille has confirmed it was targeted by an "attempted cyberattack" following claims by a threat actor who leaked a sample of allegedly stolen data on a hacking forum.

Founded 126 years ago, Olympique Marseille competes in Ligue 1, the top tier of French football, and made history as the first French club to win the UEFA Champions League in 1993.

Attack Details Emerge

The incident came to light when a threat actor posted on a hacking forum claiming to have breached Olympique Marseille's systems earlier this month. The attacker leaked a sample of the allegedly stolen information and claimed to have accessed a database containing details on 400,000 individuals.

According to the threat actor, the stolen data includes:

• Names, addresses, and order information
• Email addresses and mobile phone numbers
• Information on more than 2,050 Drupal CMS accounts
• 34 OM staff accounts
• 1,770 contributor and moderator accounts

"Today I am selling Olympique de Marseille (OM) dump from feb 2026, iconic french football club in Ligue 1, online boutique for merch, fan memberships, massive supporter base in france and worldwide," the threat actor stated in their forum post.

Club Response and Security Measures

Olympique Marseille issued a statement confirming the cyberattack, describing it as an "attempted" breach in a context of "resurgence of attacks targeting large organizations."

"Thanks to the immediate mobilization of our technical teams and specialized service providers, the situation was quickly brought under control," the club stated. "To date, all our activities are continuing as normal and in complete security, and we are continuing our investigations into the scope of the incident."

The club reassured supporters that "no banking details or passwords have been compromised" and emphasized that normal operations continue.

Regulatory and Legal Actions

Olympique Marseille has taken several steps in response to the incident:

• Reported the incident to the French data protection authority (CNIL)
• Filed a formal complaint with law enforcement
• Advised fans to remain vigilant against phishing attempts
• Requested supporters report any suspicious activity

Despite the club's characterization of the incident as an "attempted" attack, the threat actor's claims suggest actual data exfiltration occurred. The discrepancy between these accounts highlights the often unclear nature of early-stage breach disclosures.

Context of Sports Organizations Under Attack

This incident follows a pattern of cyberattacks targeting sports organizations. In November, the French Football Federation (FFF) disclosed a data breach after attackers gained access to administrative management software used by football clubs through a compromised account.

The attack on Olympique Marseille underscores the growing threat to sports organizations, which hold valuable fan data and operate complex digital infrastructures for ticketing, merchandising, and fan engagement.

Security Implications for Sports Organizations

This breach highlights several critical security considerations for sports organizations:

Fan Data Protection: Sports clubs maintain extensive databases of supporter information, making them attractive targets for cybercriminals seeking personal data for identity theft or phishing campaigns.

E-commerce Vulnerabilities: The threat actor specifically mentioned the club's online boutique for merchandise and fan memberships, indicating that e-commerce platforms are often the weakest link in sports organizations' digital ecosystems.

CMS Security: The exposure of Drupal CMS accounts suggests that content management systems, frequently used for fan portals and official websites, require enhanced security measures and regular patching.

Incident Response Readiness: Olympique Marseille's ability to quickly mobilize technical teams and specialized service providers demonstrates the importance of having incident response plans in place before attacks occur.

Expert Analysis

Cybersecurity experts note that sports organizations face unique challenges in securing their digital assets. "Football clubs like Olympique Marseille have become digital businesses with millions of fans interacting through various online platforms," says a security analyst who specializes in sports industry threats. "This creates a large attack surface that requires sophisticated security measures."

The fact that the club was able to maintain normal operations while investigating the incident suggests that proper segmentation and backup strategies were in place. However, the exposure of supporter data remains a significant concern for the club's reputation and fan trust.

Moving Forward

As investigations continue, Olympique Marseille faces the challenge of balancing transparency with ongoing security operations. The club's decision to report the incident to CNIL demonstrates compliance with European data protection regulations, but fans will likely seek more detailed information about what data was compromised and what protective measures are being implemented.

For supporters, the incident serves as a reminder to remain vigilant about potential phishing attempts and to monitor their personal information for suspicious activity. The club's advice to report suspicious activity provides a mechanism for fans to contribute to the ongoing security response.

The attack on Olympique Marseille represents another example of how cybercriminals are increasingly targeting organizations with valuable customer data and complex digital ecosystems. As sports organizations continue to digitize their operations, the need for robust cybersecurity measures becomes increasingly critical.