SFR confirms data breach following cyberattack targeting its fiber subscribers

Thursday 20 August 2026 - 11:20

SFR has confirmed a data breach related to a cyberattack detected in early July. Personal information of fiber customers may have been accessed or retrieved, including email addresses, phone numbers, and postal addresses. The operator claims, however, that passwords and banking data were not exposed.

Another cybersecurity incident for SFR. The telecom operator acknowledged on Thursday, August 20, that a cyberattack in July allowed temporary access to certain data associated with its fiber subscribers' lines.

The incident was identified on July 2 by the company's security teams. SFR then began notifying potentially affected customers in mid-August, after analyzing the consequences of the attack.

Exposed personal data

According to information provided by the operator, the potentially accessible data includes postal addresses, email addresses, and phone numbers associated with fiber subscriptions.

SFR has not disclosed the exact number of affected customers at this stage.

However, the operator assures that a particularly sensitive area has not been affected. Passwords and banking information would not be part of this breach.

This distinction limits the risk of direct compromise of accounts or payment methods, but the retrieved personal data can still be exploited in phishing campaigns or targeted scams.

An attack on a connection management tool

The source of the breach lies in a software tool used by SFR to analyze connections to the fiber network.

In a letter sent to subscribers, the operator explains that the incident resulted from a cybermalicious act that temporarily made certain information related to fiber lines accessible.

Upon detecting the attack, SFR states that it halted access to the affected tool and deployed additional security measures to limit the consequences of the incident and prevent further exploitation of the vulnerability.

The CNIL and justice involved

SFR has also initiated the regulatory and judicial procedures required in such situations.

The operator declared that it has notified the data breach to the National Commission on Informatics and Liberty (CNIL). This notification is part of the obligations imposed on companies when a personal data breach presents a risk to the affected individuals.

A complaint has also been filed with the Public Prosecutor, according to SFR.

Customers urged to remain vigilant

Even in the absence of banking data or passwords in the exposed information, affected subscribers should remain alert to unusual solicitations.

A combination of email address, phone number, and postal address could allow fraudsters to personalize their scam attempts. A message appearing to come from SFR, a banking institution, or an administrative service may seem more credible when it contains real information about its recipient.

Caution is therefore advised regarding links received by email or SMS, requests for security codes, and solicitations inviting the sharing of confidential information.

A new episode following the 2024 breach

This incident comes as SFR had already faced a data breach in 2024. The recurrence of such events illustrates the risks that telecom operators now face, which hold significant volumes of data related to their customers.

For SFR, the priority now is to contain the consequences of the attack and to strengthen the protection of its systems. For affected subscribers, the challenge lies primarily in identifying any potential fraud attempts using the personal information that may have been compromised.