358,000 Réglo Mobile (Leclerc) customers affected by a data leak

On 18 February 2026, Réglo Mobile — the low-cost mobile virtual network operator (MVNO) backed by E.Leclerc and run on the SFR network — notified its customers of a data breach affecting roughly 358,000 subscribers.

The incident did not originate in Réglo Mobile's own systems but in those of one of its subcontractors. According to the operator, an attacker gained access to the third-party provider's environment starting around 13 February 2026 and exfiltrated data tied to customer accounts. Réglo Mobile said it was alerted a few days later, patched the exploited vulnerability, and contained the incident within hours of detecting it. Shortly afterwards, an actor using the handle "84City" advertised and put up for sale a database of more than 358,000 Réglo Mobile customers on a cybercrime forum.

The exposed data covered a broad range of personal information:

• Full names and dates of birth
• Postal and email addresses
• Phone numbers
• PUK codes and communication/call records
• Partial banking data (truncated IBANs and masked card numbers)

Réglo Mobile stressed that account passwords were not affected and that the partial banking details could not, on their own, enable direct fraudulent transactions. However, security observers warned that the combination of identity, contact and line data creates a significant risk of targeted phishing, fraud and SIM-swapping attacks, and customers were urged to remain vigilant against unsolicited messages and account-takeover attempts.