Loading story…
Eurofiber France experienced a cyberattack on November 13, 2025, in which threat actors exploited a vulnerability in the company's ticket management platform. The breach resulted in the exfiltration of data related to Eurofiber France and its regional brands, including Eurafibre, FullSave, Netiwan, and Avelia, as well as the cloud division operating under Eurofiber Cloud Infra France. The incident was limited to the French business unit, with no impact on Eurofiber's operations or customers in Belgium, Germany, or the Netherlands. Sensitive information such as banking details and critical data stored in other systems was not compromised, and the vulnerability has since been patched.
Following detection, Eurofiber implemented enhanced security measures on the affected platforms and worked with cybersecurity experts to support impacted clients. The company notified all affected customers and reported the incident, which included an extortion-related component, to French authorities CNIL and ANSSI. Operational impact was minimal, with customer-facing services remaining fully functional, and additional steps have been taken to prevent further breaches and strengthen overall system security.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Following the breach, Eurofiber France notified French authorities including CNIL and ANSSI and filed a report related to the extortion attempt. The reporting reflected the company's position that attackers had stolen data and demanded payment to prevent its publication.
Eurofiber France disclosed the incident publicly, stating that stolen data did not include banking details or other critical data and that the breach was limited to its French unit and related brands. The company said it would notify affected customers about the compromise.
After the breach, a threat actor using the name 'ByteToBreach' claimed on a data leak forum to have stolen ticket-system uploads from about 10,000 business and government clients. The actor alleged the data included screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backups.
Shortly after detecting the intrusion, Eurofiber France secured the compromised ticketing platform and ATE portal, closed the exploited vulnerability, and implemented strengthened security measures. The company said customer-facing services remained operational, though some internal and partner-facing systems saw limited impact.
On 2025-11-13, attackers exploited a vulnerability in Eurofiber France's ticket management system, affecting only the company's French operations, including its cloud division and regional brands. The intrusion led to data theft and was later described by the company as linked to an extortion attempt.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourceeurofiber.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French telecommunications provider **Bouygues Telecom** disclosed a cyberattack that led to the exposure of nearly **6.4 million customer records**, including **5.7 million unique email addresses**. The compromised data reportedly included names, physical addresses, phone numbers, dates of birth, and **IBANs**, raising concerns about fraud and financial abuse. The company said affected customers were notified after detecting the intrusion into its services. French electronics retailer **Boulanger** also suffered a major breach in which more than **27 million rows of data** were exposed, including **2 million unique email addresses**. The leaked information reportedly included names, physical addresses, phone numbers, and even **latitude and longitude** data. Unlike the Bouygues incident, the stolen Boulanger dataset was later posted publicly on a hacking forum, significantly increasing the likelihood of downstream misuse, phishing, and identity-related abuse.
Jun 29, 2026
The French Football Federation (FFF) suffered a significant cyberattack in which threat actors exploited a compromised user account to access the federation’s administrative management software. This breach resulted in the theft of sensitive personal data belonging to over two million registered amateur football players and club members, including names, dates and places of birth, nationalities, postal and email addresses, phone numbers, and football license numbers. Financial data and passwords were reportedly not affected. Upon discovering the breach on November 20, 2025, the FFF immediately deactivated the compromised account, reset all user passwords, and secured its systems. The FFF has filed a formal complaint with French authorities and notified both the National Cybersecurity Agency (ANSSI) and the National Commission on Informatics and Liberty (CNIL). Affected individuals whose email addresses were exposed are being contacted directly, and the federation has urged all members to be vigilant against potential phishing attempts and scams leveraging the stolen data. This incident highlights the growing cyber risks faced by sports organizations and underscores the need for robust cybersecurity measures to protect large volumes of personal information managed by such entities.
Jul 12, 2026
Ukraine’s National Bank (NBU) took its **collectible coin/numismatic online store** offline after a cyberattack against a supporting **contractor** potentially exposed customer registration data (names, phone numbers, emails, and delivery addresses). The NBU said **core banking systems were not affected** and **no payment card or banking data** was compromised, but warned the exposed PII could be leveraged for **phishing** and other follow-on fraud; the incident was described as consistent with a **supply-chain** intrusion path. In France, authorities disclosed illegal access to a portion of the **National Bank Accounts File (FICOBA)**—a government database used for tax, customs, and law-enforcement purposes—after an attacker **impersonated a civil servant** and used valid credentials to query data. Officials said up to **1.2 million accounts** may have been impacted, with exposed fields potentially including account numbers, names, addresses, and in some cases tax identifiers; **DGFiP**, supported by **ANSSI**, is investigating and notifying affected individuals while banks were alerted to heighten fraud/phishing monitoring. Separately, **Safran Group** denied being cyberattacked, stating that a leaked dataset containing “non-strategic” order/customer details was **inadvertently exposed via a third-party provider**, with external analysis suggesting the compromise occurred elsewhere in the supply chain rather than within Safran’s own systems.
Jun 29, 2026