The medical records are the sharp end
World Triathlon told its national federations on 13 November that attackers had copied complete database tables, including athletes’ medical information for event doctors. The memo, signed by Secretary General Jon Wyatt and published by Triathlon Ireland, went out on the opening day of the Multisport Championships in Abu Dhabi, where thousands of athletes had gathered to race for world titles across nine disciplines, with racing starting the next day.
Slowtwitch reported the breach on 14 November, the same day German outlet tri-mag.de published its account. World Triathlon, the sport’s global governing body based in Lausanne, Switzerland, has 172 affiliated national federations, according to Slowtwitch.
The data taken goes well beyond names and email addresses. Member, athlete and entrant records were copied, tying names to contact details, countries, national federations, and entries and results history. Medical data provided by athletes for medical delegates at events was downloaded, with allergies, illnesses and medication given as examples. Technical official and coach records were taken too, including positions, evaluations and certifications, along with National Federation and Confederation contact details.
Passwords for World Triathlon’s NF Portal and Entries accounts were also copied, stored in hashed form. World Triathlon said the original passwords are not retrievable from the hashes. A hash is not designed to be reversed, but how well one resists cracking depends on the algorithm and password strength, which the memo does not specify.
A governing body that holds athletes’ medical declarations cannot treat a reporting tool as low-risk plumbing. Entries and results history makes the phishing that follows unusually convincing, because a scam could name a real race you entered.
The dates tell the story
A critical Metabase flaw was disclosed 92 days before the copy, Singapore’s cyber agency warned it was being actively exploited two days before, and press reports followed eight days after.
| Date | What happened | Gap to the copy |
|---|---|---|
| 6 Aug 2026 | Metabase discloses critical flaw, later assigned CVE-2026-72898, severity 10.0 | 92 days before |
| 4 Nov 2026 | Singapore’s Cyber Security Agency warns the flaw is being actively exploited | 2 days before |
| 6 Nov 2026 | Attacker copies complete World Triathlon database tables | The copy |
| 7 Nov 2026 | Hacking-forum post claims to offer the data for download | 1 day after |
| 8 Nov 2026 | World Triathlon identifies the breach and shuts the tool down | 2 days after |
| 13 Nov 2026 | Memo to national federations | 7 days after |
| 14 Nov 2026 | tri-mag.de and Slowtwitch report the breach | 8 days after |
The attacker had been extracting names, email addresses and postal addresses, including the National Federation contact list, before the full tables were copied on 6 November. World Triathlon identified the breach on 8 November and shut the tool down the same day. The memo does not say how the breach was detected.
Its official status page logged the incident as identified on 8 November at 12:11 UTC and resolved on 9 November at 12:09 UTC.
The flaw in the background is not the confirmed vector
World Triathlon has not identified which Metabase vulnerability was exploited, or which version it was running. The flaw most people will assume is behind this breach is a different, named one, and the link is unconfirmed.
On 6 August 2026, Metabase disclosed that attackers had used a previously unknown vulnerability against its cloud service and released patched versions. The flaw, an unauthenticated SQL injection in the password-reset endpoint, can give an attacker administrator access. It is tracked as CVE-2026-72898, severity 10.0 out of 10. Computer maker Framework told customers in August 2026 that their data had been exposed in the Metabase cloud breach.
Metabase patched its cloud service, but self-hosted installations must be upgraded by their operators. In August 2026, Dataminr reported finding approximately 11,000 self-hosted Metabase instances online, 4,309 of them potentially vulnerable. On 4 November, Singapore’s Cyber Security Agency warned the flaw was being actively exploited and that a proof-of-concept exploit was publicly available. All of that is background. None of it proves this flaw was used against World Triathlon.
There is precedent for athlete medical data being a target. In 2016, the Russia-linked hacking group Fancy Bear used an account created for the Rio 2016 Games to access the World Anti-Doping Agency’s anti-doping system and leak therapeutic use exemption information. In 2017, the IAAF, now World Athletics, said it believed an attack attributed to the same group had compromised athletes’ therapeutic use exemption applications, though it was not known whether the information was subsequently stolen. Whether therapeutic use exemption applications were affected here is unknown; the memo does not say.
What should I do if my World Triathlon data was taken?
Treat any message about the breach as suspect until you confirm it through World Triathlon’s own channels. Your NF Portal and Entries passwords are already reset, so change the same password anywhere else you reused it, and verify any payment request by phone or direct message before acting on it.
- Confirm any notice through World Triathlon’s official website or social media, never through links in a message.
- Expect phishing messages that could name real races you entered, because your entries and results history were taken.
- Verify every payment request by phone or direct message with the contact you already know.
- Change the password on any other account that uses the same one as your NF Portal or Entries login.
- Check your accounts for logins from unusual places, unexpected setting changes, or lockouts you did not cause.
- Report anything suspicious to technology@triathlon.org, and in the UK forward scam emails to the NCSC at report@phishing.gov.uk.
World Triathlon has already reset passwords for all NF Portal and Entries accounts, signed every user out, changed the affected databases’ credentials, and preserved evidence. It engaged a cybersecurity firm for a forensic investigation and reported the incident to the Swiss Police, the Swiss Federal Data Protection and Information Commissioner, and under EU and UK GDPR. Affected individuals will be notified directly by email.
What is confirmed, and what is not
Confirmed: an unauthorised party exploited a flaw in Metabase to reach World Triathlon’s databases and copy personal records. Complete tables were copied on 6 November, the breach was identified on 8 November, and the tool was shut down the same day. Medical data, contact details, entries and results history, official and coach records, and hashed account passwords were taken. No financial data was accessed. Fraudsters have already used lookalike email domains to request payments to new bank accounts.
Not confirmed: whether the stolen data is actually circulating, has been sold, or has been downloaded by third parties. The 7 November hacking-forum post claimed to offer the data for download, as World Triathlon’s own memo puts it, but no sample, price, buyer or download evidence has been published. No group has claimed responsibility, and no ransomware angle has been reported. World Triathlon has not said how many people are affected, and the coverage so far gives no total either. Do not take any number you see for that as fact until World Triathlon publishes one.
Slowtwitch notes German outlet tri-mag.de and Spain’s Triatlón Noticias have also reported on the incident. Under GDPR, people in the EU and UK can request access to the personal data an organisation holds about them; World Triathlon directs legal questions to legal@triathlon.org.
What to watch next
First, watch for an affected-count disclosure from World Triathlon. Until one appears, the scale of this breach is genuinely unknown. Second, whether World Triathlon names the Metabase flaw or version exploited, or confirms the August CVE-2026-72898 flaw as the vector. Third, whether the forum-offered data surfaces anywhere, with a sample or a sale, which would move the forum post into confirmed circulation.
Individual notification emails to affected athletes are worth watching, along with any comment from the Swiss data protection regulator or European regulators. Coverage so far spans Slowtwitch, German outlet tri-mag.de and Spain’s Triatlón Noticias, alongside federation notices relaying the memo. The tables were copied nine days ago, on 6 November. Fraudsters have already used lookalike email domains to request payments to new bank accounts, according to the memo.
