World Triathlon Data Breach Exposed Athlete Medical Information and More - Slowtwitch News

The attack began on November 6 when the attacker repeatedly extracted names, email addresses, and postal addresses from the databases, including the National Federation contact list. By November 7, a post on a hacking forum claimed to offer the data for download, and the organization identified the breach on November 8.

World Triathlon has taken immediate steps to secure its systems, including shutting down the affected tool and changing credentials for the affected databases. The organization has also reset passwords for all NF Portal and Entries accounts and signed out every user.

The memo, dated November 13 and signed by Secretary General Jon Wyatt, states that the attacker exploited a security flaw in Metabase, a third-party reporting tool, to reach the databases. The memo does not specify how the breach was detected.

The incident has exposed six categories of data, including member, athlete, and entrant records; medical data; technical official and coach records; the national federation contact list; and account passwords in hashed form. No financial data was accessed.

Medical Data Exposed

Medical data submitted for race-day care was downloaded, including allergies, illnesses, and medication. World Triathlon event pages state that medical information provided at entry is saved in the athlete’s profile for future events and passed to the medical team at each event the athlete enters.

The memo says medical data provided by athletes and needed for medical delegates at events was downloaded. It does not say whether other medical records World Triathlon handles, such as therapeutic use exemption applications, were affected.

The memo lists performance evaluations and certifications for technical officials and coaches. World Triathlon runs courses for officials and coaches through its Education Hub, according to its privacy notice.

The national federation contact list was extracted, along with confederation contact details. The memo states that fraudsters have already used lookalike email domains to request payments to new bank accounts.

Metabase Vulnerability

World Triathlon has not identified which Metabase vulnerability was exploited or which version of the software it was running. The organization has engaged a cybersecurity firm for a forensic investigation.

On August 6, Metabase disclosed that attackers had used a previously unknown vulnerability against its cloud service, releasing patched versions. The flaw, an unauthenticated SQL injection in the tool’s password-reset endpoint, can give an attacker administrator access. It is tracked as CVE-2026-72898 and carries a severity score of 10.0 out of 10.

Metabase’s cloud service was patched by the company; however, self-hosted installations must be upgraded by their operators. In October, Dataminr reported finding approximately 11,000 self-hosted Metabase instances online, with 4,309 of them potentially vulnerable.

On November 4, Singapore’s Cyber Security Agency issued an alert stating that the flaw was being actively exploited in these self-hosted instances and that a proof-of-concept exploit was publicly available.

Next Steps and Warnings

World Triathlon has reported the incident to the Swiss police and the Swiss Federal Data Protection and Information Commissioner (FDPIC), under EU and UK GDPR. The organization has also preserved evidence and signed out every user from the compromised accounts.

World Triathlon has asked federations to verify any payment request by phone or direct message with the known contact. Federations are also advised to review their own obligations, as they may have notification duties under national law for member data they provided to World Triathlon.

Affected individuals will be notified directly by email. Guidance from World Triathlon and the NCSC includes confirming any notice through official channels, expecting targeted phishing, and changing reused passwords.

Individuals are advised to check accounts for unauthorized activity, such as being locked out or unexpected changes to security settings, and to use tools like haveibeenpwned.com to see whether their details appear in other public breaches.