Stade Français Paris Hit by Qilin Ransomware Attack, Data Leak Threatened French rugby club Stade Français Paris confirmed a cyberattack disrupted its information systems, though the club restored operations using clean backups. While its ticketing platform and online store remained unaffected, a sample of allegedly stolen data was published online. The club is investigating the breach’s scope and has notified authorities, filing a criminal complaint though it has not disclosed whether a ransom demand was made or negotiations are underway. The ransomware group Qilin claimed responsibility, posting documents belonging to 18 players on its darknet leak site and threatening further releases unless a ransom is paid by the end of next week. The authenticity of the leaked files has not been independently verified. Qilin, a prominent ransomware-as-a-service operation linked to Russian-speaking cybercriminals, employs double extortion tactics encrypting systems while stealing data to pressure victims into payment. The group has been active in targeting high-profile organizations, including sports teams. Stade Français joins a growing list of sports organizations victimized by cyberattacks. Recent incidents include Dutch soccer club Ajax (2024), Italian club Bologna FC (2024), Paris Saint-Germain (2024), Manchester United (2020), the Royal Dutch Football Association (2023), and the French Football Federation (2025). These attacks highlight the rising threat of financially motivated hackers against the sports sector.

Royal Enfield’s Corporate Network Allegedly Hit by Full Ransomware Compromise A threat actor has claimed a full-scale breach of Royal Enfield’s corporate network, posting details on a prominent dark-web leak forum. According to the attackers, every server was encrypted, and all backups were wiped a tactic aligning with MITRE ATT&CK technique T1486 (Data Encrypted for Impact). The group provided a session ID, qTox handle, and Telegram contact, demanding an undisclosed ransom within 12 hours while also soliciting third-party bids for the stolen data. Screenshots shared by the attackers suggest a double-extortion model, combining data exfiltration with encryption to increase pressure on the victim. While Royal Enfield has not confirmed the breach, the attackers claim to possess "proof-of-access" files, indicating prior reconnaissance and credential harvesting (T1078 – Valid Accounts) before deploying the ransomware. Cybersecurity analysts note that similar attacks in the automotive sector have exploited remote-file-transfer vulnerabilities. The incident highlights risks of operational downtime, intellectual property theft, and potential regulatory fines if sensitive data is exposed. Experts have previously flagged Chacha → Base64 patterns in ransom-note drop scripts as a red flag for such intrusions.