Data security incident

Information for our customers: security incident involving ski hire booking data

Published on 21/08/2026 · Last updated on 08/10/2026

Sport 2000 has been informed that a security incident affected one of its internal tools for managing ski equipment hire bookings, and that certain personal data relating to bookings may have been accessed, and even made public, by an unauthorised third party. We are providing full and transparent information here about this incident, its possible consequences and the precautions to take.

What happened

On 20 August 2026, we learned that an unauthorised third party had accessed our internal ski hire booking system and had viewed and exported booking data, part of which had then been made public.

On 5 October 2026, we were informed that all the data exfiltrated during the aforementioned incident appears to have been made public that same day on a forum “specialising” in data leaks.

Who is affected?

If you made a ski hire booking with Sport 2000 or Ekosport Rent, or if a third party made such a booking on your behalf or named you in a booking (for example as a “skier”), your data may be affected.

Please note: if you made a booking that included other people, for example “skiers” named in that booking, their data may also be affected. Therefore, we ask you to inform them of the security incident that may have affected their data and to make them aware of the information, precautions and points of vigilance we have shared with you. To do so, please forward this message to them and/or share with them the link to the dedicated information page available on the ski hire websites concerned (see https://www.ekosport-rent.com/fr/informations-legales/4329-incident-de-securite-des-donnees).

Data that may be affected

Depending on the booking, the data exposed may include:

• data relating to the customer who made the booking: surname, first name, country, town/city, postcode, email address, “Loyal customer” badge and loyalty level;
• information relating to the booking: booking number, voucher number, distributor, shop, resort, hire start and end dates, hire duration, booking date, booking status, booking source, payment type (30% deposit / 100% full payment), whether an online booking exists, by whom it was made and its date;
• information on the products and services booked: reference, category, related options/accessories, first name, skill level, age, shoe size, weight and height of the associated skier, where applicable the mobile phone number provided for the skier, base price, discount percentage and description, final price;
• the financial summary of your booking: equipment total before discount, online discount, details of each discount or benefit (name, amount, reference, value, code, type), basket total after discount, services total, booking fee, insurance total, booking total including VAT (of which VAT), information such as “already paid” or “balance to be paid in store”.

This incident does not involve any bank details (neither card numbers nor IBANs), nor any customer passwords.

Risks to be aware of

Because it contains genuine booking details, this information could be used to send you highly convincing fraudulent messages (emails, text messages or phone calls) — for example by impersonating Sport 2000, Ekosport Rent or one of their shops — in order to induce you to disclose personal or banking information, or to make a payment. We therefore urge you to remain vigilant.

How to protect yourself

• Remain vigilant regarding any message or call referring to a Sport 2000 or Ekosport-Rent booking, even if it appears legitimate and contains accurate information.
• Never disclose bank details, login details or passwords in response to an unsolicited message.
• Do not click on links in suspicious messages and do not open unexpected attachments.
• Verify any request by going directly to the website: https://location-ski.sport2000.fr (by typing the address into your browser yourself) or by contacting customer service at serviceclient@sport2000.fr or your usual shop using its known contact details.
• Be wary of any request for payment, refund or booking “confirmation” received by message.
• You can also find advice and information on the French government website https://www.cybermalveillance.gouv.fr.

Measures we have taken

• Securing of the affected system and strengthening of our personal data protection measures.
• In-depth analysis to determine the origin and scope of the incident.
• Notification of the incident to the French data protection authority (Commission nationale de l'informatique et des libertés – CNIL).
• Filing of a complaint with the French Gendarmerie.
• Individual notification of the customers affected by the incident.

Your contact

For any questions regarding this incident or your personal data, you can contact our Data Protection Officer by email at: dpo@sport2000.fr or by post: DPO Sport2000 - Route d’Ollainville, 91520 Egly, France.

You have rights over your personal data (access, rectification, erasure, objection, etc.), which you can exercise via this contact. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

We apologise for any inconvenience caused and remain fully committed to protecting your data.

The Sport 2000 team