World Triathlon has confirmed that an attacker copied its athlete, entry and medical records between 6 and 8 November 2026 through a flaw in a reporting tool.
The5krunner’s take: Well, they’ve got my details for starters. If you have entered a World Triathlon event or hold a federation licence, treat every email about entries, refunds or payments as suspect, because the attacker now has what it needs to make one convincing.
- The attacker used a flaw in Metabase, a reporting tool, to copy whole database tables on 6 November, a hacking forum post offered the data for download on 7 November, and World Triathlon shut the tool down on 8 November (member notice).
- The records include names, email and postal addresses, country, national federation, race entries and results history.
- Medical details that athletes give to event medical delegates, such as allergies, illnesses and medication, were also accessed.
- Technical officials’ and coaches’ evaluations and certifications were taken, along with national federation contact lists.
- Passwords for the NF Portal and Entries were stored in hashed form; all have been reset, and every user signed out. World Triathlon says no financial data was accessed.
- The incident has been reported to Swiss police, the Swiss data protection commissioner, and EU and UK regulators, and each affected person will get an email directly from World Triathlon.
For triathletes: expect scam emails that know your race history
The stolen tables pair your name and email address with the races you entered and your results, which is exactly what a scammer needs for a believable “your entry needs payment” message. Fraudsters have already used lookalike email domains to ask federations to pay new bank accounts, so check any payment request by phone with someone you know. A hashed password is hard to recover, but if you used the same one elsewhere, change it there. The medical notes are the more serious loss because, unlike a password, they cannot be reset, and the Ultrahuman breach showed how slow sports tech firms can be to tell users. With Hyrox joining World Triathlon, the same systems are likely to hold far more people’s details before long.
Quick answers
Was my data taken in the World Triathlon breach?
World Triathlon is emailing each affected athlete, official and coach directly. If you have entered one of its events or hold a licence through a national federation, watch for that email and treat other messages about it with caution.
Do I need to change my password?
World Triathlon has already reset every NF Portal and Entries password. Change the same password anywhere else you used it.
Related: the Under Armour data breach and Hyrox joins World Triathlon.
Source and original research by: the5krunner and Triathlon Ireland.
If you enjoyed this quick read, here are three more in the series:
- Garmin patent puts solar cells between pixels
- You’ve been tying your running shoes the wrong way
- Smartwatches could learn how well you feel you slept
Last Updated on 15 November 2026 by tfk the5krunner
Small things I always use
- Garmin 90-degree charging adapter: Charges your Garmin with any USB-C cable. Essential when travelling. I use one.
- Body Glide: The blue anti-chafing stick swimmers and runners carry. I use it.
- Speedo earplugs: Fewer ear infections and no cold-water dizziness. I use them.
- Dryrobe Advance: My winter changing robe for open-water swims. I use one. A cheaper option is the AONYIYI changing robe.
- Maurten: Race fuel that stays easy on the stomach. I use them.
- Beet It Sport nitrate shots: Beetroot shots I take in the days before a race. I use them.
- Garmin charging puck: The quickest way to top up before a session. I use one.
- Injinji: Toe socks that stop rubbing, so you run more. I use them.
- Ultimate toe protectors: Stop black toenails on long runs. They work. I use them.
- Compressport R2 v2 calf sleeves: My calf sleeves of choice. I use them.
- Cellucor C4: My pre-workout before hard sessions.
- TPU tubes: Schwalbe Aerothan, Tubolito and Pirelli SmarTube. Light, tiny spares. I use all three.
- G8 insoles: Adjustable arches, perfect position. I use them.
- Cycplus Cube: A 97g electric pump that gets a road tyre rideable in two minutes. I carry one. 5% off with code THE5KRUNNER.
Health, recovery and sleep
- Kineon MOVE+: Red and infrared light for sore knees, Achilles and other joints after hard training. I use it.
- FreeStyle Libre 3 Plus: Shows how my blood sugar responds to diet. Occasional use.
- hDrop: Measures my sweat loss in summer and indoors. I use it.
- Fourth Frontier Zone: Checks my heart under load in hard sessions.
- Oura Ring 5: My partner’s recovery tracker of choice.
- Eight Sleep: A cooling mattress cover my partner and I use nightly.
Watches and sensors
- Polar H10: My daily driver for waking HRV.
- Polar Verity Sense: My backup arm-worn HR sensor.
- Nomad bedside charger: Charges my iPhone and Apple Watch overnight. I use it, and many of their bands.
- Train.Red: The best muscle oxygen sensor I’ve used. Occasional use.
- Tymewear: Accurate heart rate and reliable ventilatory zones. I use it to pace endurance rides over an hour.
- Garmin Forerunner 970: A pro-grade triathlon watch. I use this.
- Apple Watch Ultra 4: My daily smartwatch. No phone needed on rides.
On the bike
- Continental GP5000 for everyday riding, and Aero 111 on the front for special occasions. I use both.
- Helmets: Specialized S-Works Evade 3 for road riding, and Rudy Project Wing for TT-style races. I use both.
- Ravemen FR300: A front light that mounts under your Garmin or Wahoo. I use one.
- Ravemen FR1000: The light and the computer mount in one unit, so nothing else goes on the bars. Better than mine.
- Ravemen FR1500SE: 1,500 lumens hanging under your Garmin, for proper night rides.
- Ravemen FR1100SE: 1,100 lumens under your Garmin, and up to 46 hours on slow flash.
- Ravemen FR500: A brighter FR300 with the same mount.
- Wahoo TRACKR Radar: I use it on one bike and Varia on the other. They perform the same.
- Garmin Varia RTL515: Radar that warns you of cars from behind. I use this model.
- Wahoo ELEMNT Roam 3: The bike computer that’s easy to use. I use mine on most rides.
- Favero Assioma Pro RS2: Accurate power pedals that swap easily between bikes. I use this model.
Home and indoor training
- NPE Runn: Makes my basic treadmill smart, sending more accurate speed and distance to my watch and Zwift. I use it.
- Google Wifi: Keeps Zwift connected in my pain cave. I use it.
- Apple TV 4K: Zwift on the big screen. I use two.
- Google Nest Doorbell (wired, 2nd gen): My video doorbell, running in both Google Home and Apple Home via Starling. I use it.
Reader-Powered Content
This content is not sponsored. It’s mostly me behind the labour of love, which is this site, and I appreciate everyone who supports it.
Support the site: Follow (free, fewer ads) · Subscribe (paid, ad-free) · Buy Me A Coffee
Written by real people, with AI assistance. Fact-checked and verified for originality. See the Editorial Policy. FTC: Affiliate Disclosure — some links pay commission. As an Amazon Associate, I earn from qualifying purchases.
tfk is the founder and author of the5krunner, an independent endurance sports technology publication. With 20 years of hands-on testing of GPS watches and wearables, and competing in triathlons at an international age-group level, tfk provides in-depth expert analysis of fitness technology for serious athletes and endurance sport competitors. See the gear tfk uses. ID
