Belgian Table Tennis Federation Investigates Cyberattack After Hacker Claims Data Theft

On Monday, September 21, 2026, Belgium's national table tennis federation and its French-speaking branch confirmed they are actively investigating a cyberattack after a hacker claimed to have successfully extracted the personal data of tens of thousands of members. The breach, which was first flagged by the data-leak monitoring website FrenchBreaches, specifically targets the Royal Belgian Table Tennis Federation (FRBTT) and the Association Francophone de Tennis de Table (AFTT). This incident has immediately raised alarms across the Belgian sports community, as national federations scramble to secure their digital infrastructure against increasingly sophisticated extortion attempts. The attack highlights a growing vulnerability for sports organizations, which often manage vast databases of personal information but may lack the enterprise-grade cybersecurity defenses typically employed by financial institutions.[1][2][3]

A hacker operating under the online handle Venus1337 quickly took responsibility for the intrusion, posting purported samples of the stolen information online and claiming to hold a total of 1.69 gigabytes of compromised data. According to the specific claims circulated by the attacker, the dataset is extensive, including detailed records for 66,852 registered members and 17,441 system users, alongside administrative accounts utilized by local clubs. The purported data samples posted to illicit forums contain sensitive personal information such as full names, official membership numbers, and internal records related to sporting sanctions. While the hacker has boasted about the sheer volume of the extraction, federation officials are currently working alongside external cybersecurity experts to verify the exact nature and authenticity of the exposed files.[1][2][3]

AFTT President Jean-Michel Mureau publicly confirmed the cyberattack over the weekend, stating that the federation was initially alerted to the incident on Thursday. Upon discovering the unauthorized access, the organization immediately tasked its external IT provider with determining the precise scope of the breach and securing the network. "I can confirm that there was indeed an attack," Mureau said in a formal statement addressing the situation. "We have tasked our IT department with investigating to determine exactly what data was compromised." The rapid public acknowledgment reflects a growing standard among European organizations to quickly disclose potential data exposures, allowing members to remain vigilant against secondary threats such as targeted phishing emails or identity theft attempts.[1][2]

In a subsequent update released on Monday, the AFTT emphasized that it is taking the incident very seriously, but noted that its initial internal checks have not yet revealed any definitive evidence that its core infrastructure was fully compromised. Furthermore, the organization stated that it has found no proof so far that highly sensitive contact details, such as members' personal phone numbers and email addresses, were successfully extracted by the attacker. The federation's service provider, which is responsible for hosting and maintaining the official website, is also conducting a thorough forensic review of its own systems. The AFTT has proactively strengthened the security protocols across its network as a precautionary measure, promising to directly notify any affected individuals if their personal data is confirmed to be compromised.[1]

The table tennis breach is not an isolated incident within the Belgian sports landscape. Just days earlier, on September 14, the French-speaking Gymnastics Federation (FfG) suffered a strikingly similar network intrusion. The exact same hacker, Venus1337, claimed responsibility for the gymnastics breach, asserting that they had obtained sensitive information concerning more than 200,000 registered members. The FfG warned that the potentially affected information includes names, email and postal addresses, phone numbers, and details related to coaching qualifications and judges' licenses. In response to that attack, the gymnastics federation swiftly neutralized the compromised access route, secured the affected entry points, and placed its entire IT system under enhanced monitoring to prevent further unauthorized data exfiltration.[1][2]

Following the discovery of the intrusion, the FfG formally notified Belgian cybersecurity and data protection authorities, complying with strict European data privacy regulations. The gymnastics federation issued a stark warning to its members, noting that the exposed information could potentially be utilized by malicious actors for impersonation or targeted social engineering attempts designed to obtain additional personal data or financial information. Despite the severity of the breach, the FfG stated that it had not observed any active misuse of the stolen information so far. The back-to-back targeting of two major national sports bodies has prompted other Belgian federations to urgently review their own digital security postures and backup protocols.[1]

These twin attacks in Belgium follow a broader and deeply concerning trend in neighboring France, where more than 30 distinct sports organizations have faced severe cyber threats or data breaches since late 2025. The affected French entities include federations overseeing tennis, skiing, swimming, sailing, golf, football, and shooting. While authorities have not yet established a direct, proven link between the French campaigns and the recent intrusions in Belgium, the timing and methodology suggest a clear shift in cybercriminal tactics. Earlier this month, French authorities detained an 18-year-old suspected member of the ZeroBytes hacking group, which had previously claimed responsibility for a high-profile breach of the French Handball Federation.[1]

Hackers are increasingly viewing national sports governing bodies as lucrative targets, recognizing that these organizations hold vast repositories of personal data but often operate with limited IT budgets compared to corporate entities. In a separate investigation earlier this year, French police arrested a 20-year-old suspected of carrying out dozens of breaches against national federations for athletics, motorsports, and para-sports. As the AFTT and FfG continue to navigate the fallout from the Venus1337 attacks, the incidents serve as a stark reminder that the digital playing field is becoming increasingly hostile. Sports federations across Europe are now being forced to rapidly modernize their digital defenses, ensuring that the athletes they serve are protected both in competition and online.[1]