World Triathlon Data Breach Exposed Athlete Medical Information and More

World Triathlon yesterday disclosed a data security incident in which an unauthorized party accessed its databases and copied personal records of members, athletes, entrants, technical officials, coaches, and staff — including medical information athletes provide for event medical delegates.

In a memo to national federations dated November 13 and signed by Secretary General Jon Wyatt, the international governing body said the attacker exploited a security flaw in Metabase, a third-party reporting tool, to reach its databases. World Triathlon said affected individuals will be notified directly by email.

Tables Copied November 6, Breach Identified November 8

According to the memo, the attacker repeatedly extracted names, email addresses, and postal addresses, including the National Federation contact list. On November 6, complete database tables were copied.

A post on a hacking forum on November 7 claimed to offer the data for download, World Triathlon said. The organization identified the breach on November 8 and shut down the tool the same day. The memo does not say how the breach was detected.

Medical Declarations Among the Data Taken

World Triathlon’s memo lists six categories of data. Here is what each covers, based on the memo and on information World Triathlon has published about its entry system and events.

Member, athlete, and entrant records link names to race histories. The memo says these records include names, contact details, country, national federation, and entries and results history. Entries for World Triathlon age-group championship events run through its online entry system. According to World Triathlon event pages, each entry passes from the athlete to the national federation, then to World Triathlon and the local organizing committee. The affected records can therefore tie a person’s name, email, and postal address to the specific events they entered and how they finished. The UK’s National Cyber Security Centre (NCSC) notes that criminals use breach data to make phishing messages appear legitimate.

Medical data submitted for race-day care was downloaded. The memo says medical data provided by athletes and needed for medical delegates at events was downloaded. It cites allergies, illnesses, and medication as examples. World Triathlon event pages state that medical information provided at entry is saved in the athlete’s profile for future events. That information is passed to the medical team at each event the athlete enters. World Triathlon assigns a medical delegate to its championship series events. The memo does not say whether other medical records World Triathlon handles, such as therapeutic use exemption applications, were affected.

Technical official and coach records include performance evaluations. The memo lists positions, evaluations, and certifications. World Triathlon runs courses for officials and coaches through its Education Hub, according to its privacy notice. The memo does not describe what the evaluations contain.

The national federation contact list was taken. World Triathlon has 172 affiliated national federations organized into five continental confederations. The memo says the national federation contact list was extracted, along with confederation contact details. It also says fraudsters have already used lookalike email domains to request payments to new bank accounts.

Account passwords were taken in hashed form. Passwords for World Triathlon’s NF Portal and Entries accounts were copied as hashes. World Triathlon said the original passwords cannot be retrieved, and it has reset passwords for all of those accounts. Hashing converts a password into a string that is not designed to be reversed. How well hashes resist cracking depends on the algorithm used and the strength of the original password. The memo does not specify the method.

No financial data was accessed, according to World Triathlon, and also have not said how many people are affected.

World Triathlon Reports Incident to Swiss and European Authorities

The sport’s global governing body, which is based in Lausanne, Switzerland, said it has taken the following steps:

• It shut down the affected tool and preserved evidence.
• It reset passwords for all NF Portal and Entries accounts and signed out every user.
• It changed credentials for the affected databases.
• It reported the incident to the Swiss police and the Swiss Federal Data Protection and Information Commissioner (FDPIC), and under EU and UK GDPR.
• It engaged a cybersecurity firm for a forensic investigation.

Fraud Attempts Already Reported

The memo states that fraudsters have already used lookalike email domains to request payments to new bank accounts. World Triathlon asked federations to take several steps:

• Verify any payment request by phone or direct message with the known contact.
• Brief staff and members, and share the individual notice with members.
• Review their own obligations. Federations responsible for member data they provided to World Triathlon may have notification duties under national law.
• Report anything suspicious to technology@triathlon.org.

Legal questions are being directed to legal@triathlon.org.

National federations have begun relaying the notice. Triathlon Ireland posted the memo for its members, stating that the incident took place between November 6 and 8. German outlet tri-mag.de and Spain’s Triatlón Noticias have also reported on the incident.

Metabase Disclosed a Critical Flaw in August

World Triathlon has not identified which Metabase vulnerability was exploited or which version of the software it was running.

On August 6, Metabase disclosed that attackers had used a previously unknown vulnerability against its cloud service, and it released patched versions. The flaw, an unauthenticated SQL injection in the tool’s password-reset endpoint, can give an attacker administrator access. It is tracked as CVE-2026-72898 and carries a severity score of 10.0 out of 10. Computer maker Framework notified customers in August that their data had been exposed in the Metabase cloud breach.

Metabase’s cloud service was patched by the company; however, self-hosted installations must be upgraded by their operators. In October, Dataminr reported finding approximately 11,000 self-hosted Metabase instances online, with 4,309 of them potentially vulnerable. On November 4, Singapore’s Cyber Security Agency issued an alert stating that the flaw was being actively exploited in these self-hosted instances and that a proof-of-concept exploit was publicly available.

Athlete Medical Data Has Been Targeted Before

In 2016, the Russia-linked hacking group Fancy Bear accessed the World Anti-Doping Agency’s database and leaked confidential data on top athletes, including therapeutic use exemption (TUE) information. The following year, the IAAF — now World Athletics — said it believed an attack attributed to the same group had compromised athletes’ TUE applications.

What Athletes, Officials, and Federations Can Do

World Triathlon said affected individuals will be notified directly by email. Guidance from World Triathlon and from the NCSC’s advice for individuals after a data breach includes the following steps:

• Confirm any notice through official channels. The NCSC advises checking whether you are affected through an organization’s official website or social media. Don’t rely on links or contact details in a message you received.
• Expect targeted phishing. World Triathlon warned federations to expect phishing. The NCSC notes that scam messages may arrive some time after a breach is made public, and that criminals may pose as the organization that was breached. Because the stolen records include entries and results, such messages could reference real events.
• Verify payment requests independently. World Triathlon advises confirming any payment request by phone or direct message with the known contact. This applies especially to requests to pay into a new bank account.
• Change reused passwords. World Triathlon has already reset NF Portal and Entries passwords. The NCSC advises changing the password on any other account that uses the same one.
• Check accounts for unauthorized activity. The NCSC lists warning signs such as being locked out, unexpected changes to security settings, and logins from unusual locations or at unusual times.
• Check for other exposures. The NCSC points to tools such as haveibeenpwned.com to see whether your details appear in other public breaches.
• Report anything suspicious. World Triathlon asks that suspicious activity be reported to technology@triathlon.org. In the UK, suspicious emails can also be forwarded to the NCSC at report@phishing.gov.uk.
• Federations should review their own notification duties. World Triathlon said federations responsible for member data they provided may have obligations under national law.

Under GDPR, individuals in the EU and UK can request access to the personal data an organization holds about them. World Triathlon is directing legal questions to legal@triathlon.org.

Tags: