SFR Data Breach Exposes Over 2.1 Million Customer Records

Connexionfrance

SFR Data Breach Exposes Over 2.1 Million Customer Records

First seen 23 Aug 2026, 10:16 UTC • •67.5

Article Content

1 / 3

Browse articles

ThreatCluster •August 24, 2026 at 09:46 UTC

•SFR's data breach exposed personal information of over 2.1 million customers.
•The breach was detected on July 2, 2026, involving an internal management tool.
•Customers are at risk of phishing scams using their stolen personal details.

SFR confirmed a data breach affecting its fibre customers, detected on July 2, 2026. The breach involved an internal tool used for managing fibre connections, leading to the exposure of personal data for approximately 2.1 million customers, as reported by Cyberattaque.org. Affected information includes names, addresses, mobile numbers, and contract IDs, but not passwords or banking details. SFR has taken measures to secure the system, including disabling the compromised account and monitoring involved IP addresses. The company has notified France's data protection authority, CNIL, and filed a complaint with the public prosecutor. Customers are advised to be cautious of phishing attempts using their exposed information. This incident is part of a troubling trend of data breaches in France, with multiple high-profile cases reported recently.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 49d ago How this analysis works

Timeline

2026-07-02

Data breach detected at SFR

SFR's security teams identified unauthorized access to an internal tool managing fibre connections.

Connexionfrance

2026-08-22

SFR confirms data breach details

SFR disclosed the breach affecting 2.1 million records and notified the CNIL.

Connexionfrance

2026-08-23

SFR issues customer warning

SFR advised customers to be vigilant against phishing attempts using their exposed data.

Connexionfrance

More articles in this cluster (2)

Threat Graph

9 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Phishing
T1566.002 - Spearphishing Link
T1566 - Phishing

Campaign (1)

Crédit Agricole Phishing Campaign

Organization (4)

Crédit Agricole
France Titres
SFR
Urssaf

Relationships

Crédit Agricole Phishing Campaign related to Data Breach
Crédit Agricole Phishing Campaign related to Phishing
Crédit Agricole Phishing Campaign related to Crédit Agricole
Crédit Agricole Phishing Campaign related to France Titres
Crédit Agricole Phishing Campaign related to SFR
Crédit Agricole Phishing Campaign related to Urssaf
Crédit Agricole Phishing Campaign related to T1566.002 - Spearphishing Link
Crédit Agricole Phishing Campaign related to T1566 - Phishing

Following this threat?

Track Crédit Agricole in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…