Stade Français Paris Restores Systems After Ransomware Attack: Potential Data Leak

Systems restored, ticketing and online shop still operational

Stade Français Paris has confirmed a cyberattack detected on August 7, 2026, which disrupted part of its internal information systems.

The club restored its IT environment using backups believed to be clean and returned operations to normal. According to the club, its ticketing platform and online shop were not affected and remain operational.

No technology products, vendors, software versions, or specific vulnerabilities have been identified. As a result, no targeted patches or updates are currently available to the public.

Qilin claims the operation, but the club has not confirmed attribution

The Qilin ransomware group listed the operation on its data leak site on the dark web. However, the club has not publicly attributed the attack to any specific group and has not confirmed whether it received ransom demands or entered negotiations.

Qilin operates under a ransomware-as-a-service model, providing the malware and infrastructure while external affiliates conduct intrusions and receive a share of any payments.

The usual pattern involves stealing data, encrypting systems, and threatening to publish the stolen information. In this case, a sample of documents has already appeared online.

Documents belonging to 18 players published as alleged evidence

According to the French press, the leaked material reportedly concerns documents belonging to 18 players. The attackers allegedly threatened to publish more information if the ransom was not paid by the end of the following week.

The authenticity of the documents has not been independently verified. The club is still determining whether the material is genuine, what data it contains, and how many people may be affected.

The potential scope of the exfiltration therefore remains unknown. It is also unclear whether data belonging to employees, athletes, suppliers, or supporters was stolen.

Forensic investigation and guidance for affected individuals

Stade Français has notified the relevant authorities and filed a criminal complaint. A forensic investigation is underway to reconstruct the initial access, determine which systems were compromised, and identify the parties affected.

Restoring systems from clean backups has reduced the operational impact, but it does not eliminate the risk associated with data that may have been copied by the attackers. Anyone connected to the club should be alert to emails or messages that use personal information, request payments, or prompt them to open attachments or links.

No technical indicators of compromise, account verification procedures, or specific instructions for affected individuals have been released. The club’s communications remain limited to avoid hindering the investigation and incident response.