SFR
CriticalReportedTelecoms
On 29 September 2026, an individual using the alias "Syrv4x" posted a database attributed to SFR for free on a cybercrime forum, containing roughly 15,618 rows (about 13 MB) and reportedly affecting around 13,144 distinct customers according to another outlet. Visible fields include names, postal addresses, email addresses, phone numbers, and information on contracts, orders, and technician appointments; fields related to bank details (bank name, account number) appear in the database structure without confirmation they are populated for every customer. SFR has not publicly confirmed the incident, and how the data was obtained remains unknown.
The combination of identity, contact details, and contract or technician-appointment information could be used to craft phishing messages that credibly impersonate SFR or a technician.
- Disclosed on
- September 29, 2026
- Accounts affected
- 13,144
- Sector
- Telecoms
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Email address
- Phone number
- Postal address
- Order history
- Banking data (IBAN, card)
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact