The peak national sporting body left an AWS cloud storage directory completely unauthenticated and publicly accessible. The misconfiguration exposed sensitive player registration records, team contracts, and digital passport scans before remediation.