World Triathlon Data Breach Exposes Medical Records
World Triathlon confirmed that an unauthorized third party accessed its databases and stole personal, athletic, and medical data belonging to elite and age-group competitors, planetatriatlon.com reported.
The stolen files include declared allergies, underlying conditions, and specific medications that athletes provided so medical delegates could assist them during races. The incident also exposed names, email addresses, postal addresses, country affiliations, and results histories for athletes, coaches, and technical officials.
How the Security Breach Unfolded
World Triathlon discovered the intrusion on November 8, 2026, two days after attackers extracted complete database tables. The attackers exploited a security flaw in Metabase, an internal tool the organization used to query databases and generate reports.
On November 6, the unauthorized third party copied full database tables. A post appeared on a cybercrime forum on November 7 offering the stolen data for download. World Triathlon disabled Metabase on November 8 upon discovering the unauthorized access and marked the system incident as resolved at 12:11 UTC on November 9.
Contrasting Database Exposure Levels
| Data Category | Exposed Status | Specific Contents |
|---|---|---|
| Medical and Personal Data | Exposed | Allergies, illnesses, medications, names, and contact details |
| Platform Passwords | Exposed (Hashed) | NF Portal and Entries credentials stored using hash functions |
| Financial Information | Secure | No financial records were accessed during the intrusion |
While attackers downloaded medical declarations and contact lists, World Triathlon said that full clinical health records were not compromised. Password records for the NF Portal and Entries platforms were taken, but they were stored using hash functions rather than plain text. The organization immediately reset all affected passwords and terminated active user sessions.
World Triathlon Investigates Breach and Warns of Fraud Attempts
World Triathlon hired an external cybersecurity firm to investigate the extent of the data extraction. The governing body reported the breach to the Swiss police and the Federal Data Protection and Information Commissioner of Switzerland.
Fraud attempts have already emerged following the data leak. Attackers utilized spoofed email domains that mimic official addresses to request payments directed to new bank accounts. World Triathlon advised members to verify any transfer requests through an independent channel such as a telephone call to established contacts.
Frequently Asked Questions
Which organizations have shared warnings about the breach?
National governing bodies including the Danish Triathlon Federation and Triathlon Ireland published the safety communications on November 11 and November 13, 2026, respectively.
What should affected users do with duplicated passwords?
Individuals who used their NF Portal or Entries platform passwords on other external services must change those credentials immediately to prevent secondary account compromises.
Where should suspicious messages be reported?
World Triathlon instructed members to send suspicious emails directly to technology@triathlon.org and direct all legal inquiries to legal@triathlon.org.
Related reading