World Triathlon confirms data breach involving medical data

World Triathlon has confirmed a data breach that compromises personal data of athletes, coaches, officials and federations, including medical data such as allergies, illnesses and declared medication. The organisation detected the incident on Sunday 8 November 2026 and has opened an investigation to determine its scope.

The organisation informed national federations of the incident on Tuesday 10 November. A day later, on Wednesday 11 November, the Danish Triathlon Federation circulated that communication. The investigation remains open as of 13 November.

A Metabase vulnerability and several downloads

According to the information relayed by World Triathlon, a third party exploited a vulnerability in Metabase, a tool used to query and analyse information stored in databases. That unauthorised access allowed information to be downloaded on several occasions.

The organisation says that on 6 November entire tables from its databases were copied. The following day, 7 November, the data was offered for download on a hacker forum. World Triathlon deactivated the affected system on 8 November, the same day it discovered the incident. Its status page lists a security incident related to Metabase.

What data has been compromised

According to World Triathlon’s communication, the affected records include names, email addresses and postal addresses, as well as race entries and results histories. On top of this come the health data that athletes provided in order to take part in competitions: allergies, illnesses and declared medication.

The breach is not limited to athletes. It also affects records of coaches and officials, as well as contact details of national and continental federations. In addition, the NF Portal and Entries passwords have been compromised; they were stored as hashes, a method that avoids saving them in readable text. World Triathlon states that no financial information has been accessed.

Measures taken

The organisation has reset the NF Portal and Entries passwords, closed active sessions and changed the access credentials for the databases involved. It has also reported the incident to the Swiss authorities and made notifications under European Union and UK data protection rules.

To establish what happened, World Triathlon has hired an external cybersecurity firm. It has also announced that it will contact those affected and provide further updates as the investigation progresses.

Risk of fraudulent emails and recommendations

World Triathlon has warned that the compromised data could be used to deceive athletes, coaches or federations by means of fraudulent emails. According to the communication circulated by the Danish Federation, impersonation attempts using domains similar to the official ones have already been detected, mainly to request payments.

The recommendations include verifying any payment request through an independent channel before making transfers. Anyone who has reused their NF Portal or Entries passwords on other services should change them as a precaution, and should be wary of messages asking for credentials, personal information or urgent payments.

Suspicious messages related to the incident can be reported to technology@triathlon.org. Users can also consult World Triathlon’s privacy policy to learn about their rights over their personal data.

What has not yet been disclosed

World Triathlon has not said how many people are affected. Nor has a final figure been published, or the period to which the extracted records correspond.