Data Security Incident at World Triathlon
Triathlon Ireland has been informed by World Triathlon of a Data Security Incident that took place between the 6th and 8th November 2026. Please see further details from World Triathlon below.
The breach affects World Triathlon data, including National Federation coaches, age group and elite athletes, technical officials and staff.
Please note, if your data has been affected, you will receive an individual notice from World Triathlon directly. Any queries in relation to this should be addressed to technology@triathlon.org.
World Triathlon Message
I am writing to inform you of a data security incident at World Triathlon (TRI) that affects personal data of your members, athletes, officials, coaches and staff. We regret that this has happened, and we want you to hear it from us directly.
What Happened
An unauthorised external party illegally exploited a security flaw in the reporting tool Metabase and accessed TRI databases. They repeatedly extracted names, email addresses and postal addresses, including the National Federation contact list.
On 6 November they copied complete database tables. We identified the breach on 8 November and shut the tool down the same day. A post on a hacking forum on 7 November claimed to offer the data for download.
Data Involved
- Member, athlete and entrant records: names, contact details, country, National Federation, entries and results history. Medical data provided by athletes and needed for medical delegates at events (eg allergies, illnesses, medication) was downloaded.
- Technical official and coach records: positions, evaluations and certifications.
- National Federation and Confederation contact details.
- TRI account passwords for the NF Portal and Entries, stored in hashed form (which means that the original password isn’t retrievable).
- No Financial data was accessed.
What TRI is doing
- Shut down the affected tool and preserved evidence.
- Reset passwords for all NF Portal and Entries accounts and signed every user out.
- Changed the credentials of the affected databases.
- Reported the incident to the Swiss Police, Swiss Federal Data Protection and Information Commissioner (FDPIC), EU GDPR, UK GDPR.
- Affected individuals will be notified directly by email.
- Engaged a cybersecurity firm for a forensic investigation and expert assistance.
What we ask of your federation
- Expect phishing. Fraudsters have already used lookalike email domains to request payments to new bank accounts. Verify any payment request via phone or direct message with the contact.
- Brief your staff and members. Share the individual notice with your members.
- Review your own obligations. Where your federation is responsible for member data it provided to TRI, you may have notification duties under your national law.
- Report anything suspicious to technology@triathlon.org.
Contact
Please direct legal questions to legal@triathlon.org. Technical questions to technology@triathlon.org.
* This notice was last updated on 13th November 2026
