French telecoms operator SFR confirmed to AFP on 20 August 2026 that it suffered a data breach affecting fibre subscribers, after customers began receiving notification letters. SFR's security teams detected the incident on 2 July 2026, and the intrusion targeted what the operator's letter describes as an "outil de gestion d'analyse des raccordements Fibre" (a fibre connection management and analysis tool). SFR itself has declined to state how many customers were affected. The 2.1 million figure in circulation comes from the attacker's own claim and third-party trackers, not from the operator: RTL and Les Numériques report that a group or duo calling itself ZeroBytes claimed the theft on 17 July 2026, describing roughly 2.1 million records from SFR and RED fibre customer files, while Cyberattaque.org, cited by Connexion France and actu.fr, reports a database of around 2.1 million records. SFR does not confirm that number, and Les Numériques notes the volume has not been independently verified in full.
What Happened
The accounts across sources are consistent on sequence and differ mainly on precision. SFR's security teams detected an intrusion on 2 July 2026 involving an internal tool used to manage and analyse fibre connections and to consult subscription records. Les Numériques reports, citing several outlets, that data extraction had actually begun on 30 June 2026, roughly two days before detection, which is the only source giving a start date and should be treated as single-source. On 17 July 2026, the attacker publicly claimed the haul. SFR began notifying potentially affected customers in mid-August after analysing the consequences of the attack, per walaw.press, and the operator confirmed the breach to AFP on 20 August once those letters had circulated.
SFR says it cut off the compromised access immediately. Connexion France and Les Numériques give the most detail on the response: the account used to reach the tool was disabled, the IP addresses identified as the source of the attack were blocked and monitored, and additional protection and surveillance measures were deployed. SFR notified France's data protection authority, the CNIL, as required under French data protection rules since 2018, and filed a complaint with the public prosecutor.
There is a discrepancy in the sources on SFR's breach history worth flagging. AFP-sourced reporting carried by RTL and actu.fr states SFR previously suffered a 2024 cyberattack in which some customers' banking details leaked. BFMTV, in the same news cycle, refers instead to a database targeted in 2025. Accounts differ on the date of the prior incident; what is consistent is that this is not SFR's first exposure.
What Was Taken
SFR's own statement to AFP is deliberately narrow: temporary accessibility of data linked to fibre subscriber lines, specifically postal address, email address and telephone number. The customer letter, as reported by Connexion France, lists a wider field set: title, first and last name, postal address, mobile phone number, contract identifier, and technical information relating to the fibre line. Both descriptions come from SFR, so the letter's fuller list should be treated as the working assumption for exposure scope.
SFR is explicit that passwords and banking data were not affected. That claim is repeated identically across every source and is the operator's position, not an independently verified finding.
On volume, the reporting splits along a clear line. SFR states no number at all. The attacker claim, reported by RTL, is more than two million fibre customers, with the specific figure of 2.1 million records appearing in BFMTV, Les Numériques and actu.fr. Cyberattaque.org, cited by Connexion France and actu.fr, independently reports around 2.1 million records covering both SFR and RED brand fibre customers. So the honest framing is: attacker-claimed and tracker-reported at approximately 2.1 million, operator-unconfirmed, and not fully verified independently.
The distinction between records and customers also matters. Most French coverage says "données" or "lignes" rather than "clients," and one subscriber can generate more than one row in a connection-analysis tool. Treating 2.1 million as an exact headcount of distinct people overstates what the sources support.
Why It Matters
This is a low-severity dataset by the usual scoring and a high-severity dataset by operational reality. No credentials and no payment instruments means there is no direct path to account takeover or card fraud from the dump alone. But the combination that was exposed is close to ideal for social engineering against a telecoms customer base: a verified name, a verified postal address, a verified mobile number, a contract identifier, and technical details about the specific fibre line at that address.
That last element is the part defenders should focus on. A caller who can state your contract ID and describe the technical state of your fibre connection has cleared the trust threshold most people apply to an inbound call from their ISP. This is exactly the material that turns generic vishing into convincing pretexting, and Connexion France and walaw.press both frame the risk in those terms. SFR's own guidance to customers is to scrutinise any communication claiming to come from the operator.
The wider context sharpens it. Both RTL and Les Numériques attribute this attack to the same handle behind two other recent French breaches: the DGFiP tax administration intrusion claimed on 12 August 2026, which Les Numériques reports exposed 678,437 taxpayers, and a subsequent Education Ministry breach involving 43 GB of data on pupils and staff. The Local reports that the tax office and land registry breach involved up to 600,000 records, a figure that sits close to but does not match the Les Numériques number, and that Prime Minister Sébastien Lecornu convened an emergency meeting on cyber security in response. A single actor accumulating tax records, education records and telecoms subscriber records against the same national population creates cross-referencing potential that no individual breach carries on its own.
The Attack Technique
The technical detail available is thin but pointed. Every source agrees the entry point was an internal fibre connection management and analysis tool, and the response described by SFR names the mechanism indirectly: the operator disabled "the account used to access the tool" and blocked the originating IP addresses. That is the signature of abused legitimate credentials against an internal application, not exploitation of a public-facing vulnerability. No source reports a CVE, no source reports malware, and no source describes how the account itself was obtained.
Also notable is what the tool is. A fibre connection analysis platform is a back-office utility, not a customer database in the conventional sense, yet it exposed enough joined subscriber data to yield a multi-million-record extract. The dwell time, if Les Numériques' 30 June start date is right, was on the order of two days before detection, and the extraction was substantial in that window.
What Organizations Should Do
-
Inventory back-office tools that read customer data. The breached asset was an operational diagnostic tool, not the CRM. Enumerate every internal application that can query subscriber records at scale, and apply the same access controls, logging and row-limit protections you apply to the primary customer database.
-
Enforce phishing-resistant MFA on internal application accounts. The described response, disabling a single account and blocking its source IPs, indicates credential abuse. Hardware-backed or WebAuthn MFA on internal tooling, including service and support accounts, closes the most likely path here.
-
Alert on volumetric query behaviour, not just authentication anomalies. A legitimate account pulling millions of rows from a connection-analysis tool is anomalous by volume even when the login looks clean. Set per-account query and export ceilings with automated throttling, and treat sustained bulk reads as an incident trigger.
-
Rebuild your customer verification script on the assumption that contract IDs are public. Any authentication factor present in this dataset (name, address, mobile number, contract identifier, line technical detail) is now unusable as a caller-identity proof. Move to call-back on a number the customer already holds, or in-app confirmation.
-
Send proactive vishing and smishing warnings to your own customer base. SFR's exposure creates a pool of French telecoms customers primed for ISP-impersonation calls. Any organisation serving that population, particularly banks and other carriers, should expect spillover pretexting and warn accordingly.
-
Watch for cross-breach correlation in this specific cluster. If the same actor holds DGFiP, Education Ministry and SFR data, fraud attempts against French individuals may arrive with a plausibility no single dataset explains. Fraud teams should raise sensitivity on French-resident accounts and treat correct-but-unusual identity detail as a warning sign rather than a reassurance.
Sources: More than 2.1 million customer records stolen in SFR hack | French internet provider SFR is latest victim of cyber attacks | SFR confirme son piratage de juillet 2026: plus de 2 millions de do... | SFR : les clients fibre victimes d'une fuite de données, des courri... | ''Adresse, e-mail ou numéro de téléphone" : après le fisc et l'Éduc... | SFR piraté : plus de deux millions de clients touchés, le hacker de... | SFR victime d’un piratage : plus de deux millions de données dérobé... | SFR confirms data breach following cyberattack targeting its fiber...