World Triathlon confirms theft of triathletes’ data

World Triathlon has confirmed a cyberattack on its databases in which personal, sporting and medical information on triathletes, including age-group athletes, was copied. The data include allergies, illnesses and medication declared in order to receive assistance at events. The international federation detected the intrusion on Sunday 8 November 2026.

The organisation has also detected fraud attempts: email domains resembling the official ones have been used to request payments to new bank accounts. It has not said how many people are affected or the total volume of information extracted.

What data was copied

Athlete records include names, email addresses, postal addresses, countries, member federations, race entries and results histories. They are joined by the medical declarations that participants provide so that medical delegates can treat them at events. World Triathlon does not report the theft of full medical records.

The notice sent to federations expressly identifies elite and age-group athletes, which extends the scope to mass-participation triathlon. The leak also affects coaches, technical officials and federation staff, whose roles, evaluations and certifications were copied. The access also reached the contact details of national federations and continental confederations. The General Data Protection Regulation classifies health information as a special category. World Triathlon states that no financial information was accessed.

Timeline: from 6 November to the notice to federations

According to World Triathlon, on Friday 6 November the attackers copied entire tables from the databases. The extraction was repeated several times and included the contact list of the national federations. The next day, 7 November, a post appeared on a hacking forum offering the data for download. World Triathlon acknowledges the existence of the offer but does not confirm having verified it.

The federation informed the national federations on 10 November. The Danish Triathlon Federation circulated the communication on the 11th and the Irish federation published the full text on 13 November.

How they got in: the Metabase security flaw

According to the statement, the attack took place through Metabase, a tool World Triathlon used to query its databases and generate reports from them. A third party exploited a security flaw. The organisation disabled Metabase on the same day it discovered the access, 8 November.

Its public status page recorded a security incident related to Metabase and the integrations of its management and entries systems. It was identified at 12.11 UTC and marked as resolved on 9 November, although operational resolution does not mean the investigation into the data has concluded.

Passwords and measures taken

The incident included password records from the NF Portal and Entries platforms, stored using hash functions, that is, not as readable passwords. World Triathlon reset all passwords on both platforms, closed users’ open sessions and changed the credentials of the affected databases. It also preserved evidence of the intrusion.

Authorities and ongoing investigation

The federation has hired an external cybersecurity firm to investigate what happened and determine the extent of the extraction. The investigation is ongoing. The incident has been reported to the Swiss police and to the Swiss Federal Data Protection and Information Commissioner. The notice also mentions communications related to European regulation and UK data protection law, and states that national federations will need to review the obligations that apply to them with regard to their members.

Fraud attempts and advice for those affected

World Triathlon warns of impersonation attempts that have already been detected. It asks people to verify any request for payment or transfer through an independent channel, such as a phone call to the usual contact.

The organisation will notify affected individuals by email and provide further updates as the investigation progresses. Anyone who reused their NF Portal or Entries password on another service should change it there too. Suspicious messages should be sent to technology@triathlon.org and legal queries to legal@triathlon.org. World Triathlon’s privacy policy sets out rights regarding personal data.