-
A free database of 483,953 Sport 2000 ski rental bookings appeared online on October 5, 2026.
-
The records list names, emails, and skier details, including children. However, they hold no bank data or passwords.
-
The data likely comes from the August break-in, so scams that use real trip details are the main risk.
A file that points to French sports retailer Sport 2000 surfaced on a data leak forum on October 5. It claims to hold records from the company’s ski rental booking system. Analysts who reviewed it, however, say it is far bigger than an earlier leak from the same system.
Details of the Forum Post
The file comes from pilot.sport2000.fr, the tool Sport 2000 uses to manage ski rental reservations. It is about 907 MB and holds 483,953 booking records, says FrenchBreaches, a site that tracks French leaks. Of those, 371,803 carry a validated status. Another 68,343 shows were canceled, and 43,408 are simulcasts.
The database suggests the presence of 252,054 different email addresses and 335,921 unique customers’ names. However, these numbers are not the number of affected people. One person can appear under several emails or spellings. Likewise, one booking can cover a whole family. They span 464 stores and rental points and go back to 2005.
What the Records Show
Each booking can reveal a lot. According to the published extracts, a record can include the customer’s name, email, city, and country. Some list a postal address. In addition, records name the store, the stay dates, the gear rented, and the amounts paid.
The skier details are the most sensitive part. Each skier’s first name, age, height, weight, shoe size, and skiing level can appear. Sports organizations have also faced separate data-leak claims, including one involving hackers claiming a leak of Asian Football Confederation player data.
Moreover, Fuites Infos, another French outlet, found more than 110,000 bookings that involve a child or teenager. Their details sit next to the parent’s name and email. On the plus side, the file has no bank details, passwords, or phone numbers, that outlet says.
A Previous Data Leak Involving Sport 2000
This is the second public leak from the same system. On August 19, a hacker called ZeroBytes claimed a break-in at Pilot. The group posted 17,851 bookings for free. ZeroBytes said it used an export tool inside Pilot. It said it pulled older records one by one, per Cyberattaque.org’s August report.
On August 20, Sport 2000 reportedly told customers that an unauthorized person had accessed its booking system. It said the person had viewed and taken reservation data. In some cases, the person also made it public.
Then the company secured the system and opened an investigation. It told the CNIL, France’s data protection agency, and filed a police complaint. It began warning affected customers one by one. However, Sport 2000 did not name ZeroBytes as the culprit. The company says the incident did not involve bank details or passwords.
The new file holds no booking dated after August 20. The latest valid booking came in that morning at 8:41. That is the same day Sport 2000 says it found the break-in.
FrenchBreaches says this suggests the thief took the data in August. Still, it found no sign of a new break-in in October. Therefore, October 5 may simply be the day the data went public. Proof is still missing, though. Cyberattaque.org notes that nothing public shows whether both leaks came from the same access or a second theft.
Sport 2000 faced a leak before. In April 2024, a separate dataset of retail customers went up for sale on a hacking forum. Trackers counted 3.2 million emails and 6.4 million rows.
The Real Risk: Believable Scams
First of all, there is a risk of phishing, which involves scammers sending fake messages to trick you into handing over personal info or stealing your money.
If a scammer sends a message about a booking cancellation, a refund, or a payment issue with your name, shop, dates, and the gear you purchased, such a message will appear legit. So, you might not think twice before you click whatever link came with the email.
Parents need extra care. A child’s size and age are harmless alone. However, next to a parent’s email, they make a message look more trustworthy.
Risk Mitigation Tips
If you’re a Sport 2000 customer, be wary of emails, texts, or calls about your bookings, whether the details are true or not. A few habits help:
- Skip links in booking messages. Instead, visit the official website directly.
- Do not give out your payment details via email, message, or call.
- Contact the store using their official phone number if the message seems doubtful.
- Received suspicious emails? Report it right away to your email provider.
French customers can contact the CNIL. Finally, anyone who got a notice from Sport 2000 should keep it.
Several questions remain open. For one, no one has said how the attacker got into Pilot. Sport 2000 has not commented on the October 5 file. It has not said how many customers it has contacted. Likewise, the CNIL has announced no action.
Until those answers come, anyone who rented skis through Sport 2000 should treat unexpected booking messages with caution.
