Communiqué : cyberattaque et vol de données
Publié le : 19/09/2025
Modifié le : 19/09/2025
La Fédération Française de Tennis de Table informe avoir été victime d’une cyberattaque et d’un vol de données : vigilance conseillée à tous nos licenciés.
La FFTT a récemment subi une attaque informatique compromettant la sécurité des données personnelles de ses licenciés.
Un accès non-autorisé par l’usage d’un compte compromis a permis une récupération en masse d’informations dans notre base de données des licenciés. Les données concernées incluent notamment le numéro de licence, nom, prénom, genre, date et lieu de naissance, nationalité ainsi que des moyens de contact tels que adresse postale, adresse email et numéro de téléphone. En revanche, aucune donnée concernant des coordonnées bancaires ou des données de santé n’a été atteinte.
La FFTT regrette profondément cette situation et tient à assurer que l’ensemble de ses services sont mobilisés pour gérer cette intrusion. Le service informatique fédéral travaille, en collaboration avec ses prestataires techniques, à la correction de cette faille de sécurité.
Cet incident appelle à une vigilance accrue des licenciés face aux risques potentiels qui en découlent (risques d’hameçonnage (phishing), de tentatives d’escroqueries ou encore d’usurpation d’identité).
La FFTT invite donc ses membres à la plus grande prudence face aux prochaines communications qu’ils pourraient recevoir, notamment tout message suspect ou inhabituel émanant en apparence de la FFTT ou d’un autre expéditeur (invitation à ouvrir une pièce jointe suspecte ou à communiquer vos comptes, mots de passe ou données bancaires).
Toutes les informations sur les bonnes pratiques en matière de cybermalveillance.
La FFTT va adresser une communication aux personnes concernées.
Une plainte a été déposée et les autorités compétentes ont été informées (ANSSI, CNIL).
Pour toutes informations supplémentaires concernant cet événement, les services de la fédération sont joignables par courriel à l’adresse suivante : cyber@fftt.org
bleepingcomputer.com
by Sergiu Gatlan
September 23, 2025
SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices.
SonicWall has released a firmware update that can help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices.
"SonicWall SMA 100 10.2.2.2-92sv build has been released with additional file checking, providing the capability to remove known rootkit malware present on the SMA devices," the company said in a Monday advisory.
"SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version."
The update follows a July report from researchers at the Google Threat Intelligence Group (GTIG), who observed a threat actor tracked as UNC6148 deploying OVERSTEP malware on end-of-life (EoL) SonicWall SMA 100 devices that will reach end-of-support next week, on October 1, 2025.
OVERSTEP is a user-mode rootkit that enables attackers to maintain persistent access by using hidden malicious components and establishing a reverse shell on compromised devices. The malware steals sensitive files, including the persist.database and certificate files, providing hackers with access to credentials, OTP seeds, and certificates that further enable persistence.
While the researchers have not determined the goal behind UNC6148's attacks, they did find "noteworthy overlaps" with Abyss-related ransomware incidents.
For instance, in late 2023, Truesec investigated an Abyss ransomware incident in which hackers installed a web shell on an SMA appliance, enabling them to maintain persistence despite firmware updates. In March 2024, InfoGuard AG incident responder Stephan Berger reported a similar SMA device compromise that also resulted in the deployment of Abyss malware.
"The threat intelligence report from Google Threat Intelligence Group (GTIG) highlights potential risk of using older versions of SMA100 firmware," SonicWall added on Monday, urging admins to implement the security measures outlined in this July advisory.
Last week, SonicWall warned customers to reset credentials after their firewall configuration backup files were exposed in brute-force attacks targeting the API service for cloud backup.
In August, the company also dismissed claims that the Akira ransomware gang was hacking Gen 7 firewalls using a potential zero-day exploit, clarifying that the issue was tied to a critical vulnerability (CVE-2024-40766) that was patched in November 2024.
The Australian Cyber Security Center (ACSC) and cybersecurity firm Rapid7 later confirmed that the Akira gang is exploiting this vulnerability to target unpatched SonicWall devices.
bbc.com
Imran Rahman-JonesTechnology reporter andJoe TidyCyber correspondent, BBC World Service
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex.
A person has been arrested in connection with a cyber-attack which has caused days of disruption at several European airports including Heathrow.
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex "as part of an investigation into a cyber incident impacting Collins Aerospace".
There have been hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed, with some boarding passengers using pen and paper.
"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," said Paul Foster, head of the NCA's national cyber crime unit.
The man was arrested on Tuesday evening on suspicion of Computer Misuse Act offences and has been released on bail.
The BBC has seen an internal memo sent to airport staff at Heathrow about the difficulties software provider Collins Aerospace is having bringing their check-in software back online.
The US company appears to be rebuilding the system again after trying to relaunch it on Monday.
Collins Aerospace's parent company RTX Corporation told the BBC it appreciated the NCA's "ongoing assistance in this matter".
The US firm has not put a timeline on when it will be ready and is urging ground handlers and airlines to plan for at least another week of using manual workarounds.
At Heathrow, extra staff have been deployed in terminals to help passengers and check-in operators but flights are still experiencing delays.
On Monday, the EU's cyber-security agency said ransomware had been deployed in the attack.
Ransomware is often used to seriously disrupt victims' systems and a ransom is demanded in cryptocurrency to reverse the damage.
These types of attacks are an issue for organisations around the country, with organised cyber-crime gangs earning hundreds of millions of pounds from ransoms every year.
Days of disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across many European airports, including in Brussels, Dublin and Berlin.
Flights were cancelled and delayed throughout the weekend, with some airports still experiencing effects of the delays into this week.
"The vast majority of flights at Heathrow are operating as normal, but we encourage passengers to check the status of their flight before travelling to the airport," Heathrow Airport said in a statement on its website.
Berlin Airport said on Wednesday morning "check-in and boarding are still largely manual", which would result in "longer processing times, delays, and cancellations by airlines".
While Brussels Airport advised passengers to check in online before arriving at the airport.
Cyber-attacks in the aviation sector have increased by 600% over the past year, according to a report by French aerospace company Thales.
bbc.com Joe TidyCyber correspondent and
Tabby Wilson
The EU's cyber security agency says criminals are using ransomware to cause chaos in airports around the world.
Several of Europe's busiest airports have spent the past few days trying to restore normal operations, after a cyber-attack on Friday disrupted their automatic check-in and boarding software.
The European Union Agency for Cybersecurity, ENISA, told the BBC on Monday that the malicious software was used to scramble automatic check-in systems.
"The type of ransomware has been identified. Law enforcement is involved to investigate," the agency said in a statement to news agency Reuters.
It's not known who is behind the attack, but criminal gangs often use ransomware to seriously disrupt their victims' systems and demand a ransom in bitcoin to reverse the damage.
The BBC has seen internal crisis communications from staff inside Heathrow Airport which urges airlines to continue to use manual workarounds to board and check in passengers as the recovery is ongoing.
Heathrow said on Sunday it was still working to resolve the issue, and apologised to customers who had faced delayed travel.
It stressed "the vast majority of flights have continued to operate" and urged passengers to check their flight status before travelling to the airport.
The BBC understands about half of the airlines flying from Heathrow were back online in some form by Sunday - including British Airways, which has been using a back-up system since Saturday.
Continued disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across several airports on Saturday.
While this had eased significantly in Berlin and London Heathrow by Sunday, delays and flight cancellations remained.
Brussels Airport, also affected, said the "service provider is actively working on the issue" but it was still "unclear" when the issue would be resolved.
They have asked airlines to cancel nearly 140 of their 276 scheduled outbound flights for Monday, according to the AP news agency.
Meanwhile, a Berlin Airport spokesperson told the BBC some airlines were still boarding passengers manually and it had no indication on how long the electronic outage would last.
