Data leak at SFR

On 24 November 2024, SFR — one of France's largest mobile and broadband operators — was named in a fresh data leak after a threat actor advertised a file containing personal information on roughly 3.6 million of its customers. It was the third leak tied to the operator during 2024 and surfaced just weeks after an earlier September incident that had exposed customer IBANs.

The published dataset contained personal details for the affected subscribers, including:

• First and last names
• Email addresses
• Postal addresses, postal codes and cities
• Dates and departments of birth
• Phone numbers

In addition to the main file, the attacker put a separate batch of around 150,000 IBANs (bank account identifiers) up for sale on the dark web. SFR initially disputed the disclosure, characterising the data as old and recycled from prior incidents and saying there was no evidence of a new breach. The attacker responded by releasing the full dataset for free, withholding only the 150,000 IBANs, which remained reserved for paid sale.

With names, contact details and dates of birth now circulating publicly, affected customers face an elevated risk of phishing, identity theft and account-takeover attempts. The incident remained disputed and unresolved at the time of reporting; customers were urged to be vigilant against fraudulent messages exploiting the leaked information.