SFR fibre data breach 2026: was my address or phone number leaked

On 2 July 2026 SFR found that someone had gained unauthorised access to a company tool used to manage and analyse fibre connections. That access could have made visible information linked to fibre subscriber lines. SFR itself gives postal address, email address and telephone number as examples. Passwords and bank details were not involved.

SFR cut the access, added protections, told France's privacy regulator and filed a complaint with prosecutors. Around 20 August 2026 it began sending notices to affected SFR and RED by SFR fibre customers. It has not confirmed any total. Figures of about 2.1 million records come from the attackers, not from the company.

The part most coverage leaves out

Almost every report leads with what was not taken: your password, your card, anything that opens your SFR account or moves money. That is true. It is also the least useful part of the story if you have fibre with SFR or RED.

What this kind of access leaves behind is a list of households — how to write to them, how to call or email them, and the fact that they are fibre customers. Some reporting adds names, titles, contract numbers and technical details of the line. SFR has not published a full field-by-field list, but it has said the data was the kind tied to fibre lines, not login secrets.

That combination is what a stranger can actually use. A text about a fault on your fibre can mention a real address. Someone at the door can claim they were sent about your connection. None of that needs your password. The reassuring headline and the practical risk are the same facts, read two ways.

What to actually expect

• A letter or notice from SFR or RED by SFR if the company treats you as affected. Those started around 20 August 2026. We cannot check whether you were included, and a leaked-data search is unlikely to settle it either.
• Emails, texts or calls that mention this incident or a problem with your fibre. They may show a real name, number or address so they look official.
• Someone at your door presenting as an SFR technician or partner. The useful pair here is a home address plus the fact you have fibre.
• No genuine bank or card alert that comes from this claimed breach. SFR says financial data was not involved. A message claiming your payment details were in “the SFR hack” is using the news, not what the company has confirmed.

What you can and cannot fix

If your address, email or phone number was among the fibre-line data this tool could see, that copy cannot be taken back. It is out. Nobody can honestly recall it. Changing your SFR password does not unsay an address, and SFR has not claimed it can delete what left.

What still helps, in order:

• Treat unexpected contact about your fibre or this leak as untrusted until you have checked through something you already use — the number or app on a bill you already have, not a link or callback in the message.
• Do not give anyone a password, a one-time code, a bank detail or a copy of your ID because of this incident. SFR has said those were not involved. Anyone who asks for them is not repairing the leak.
• Tell the people who share your home. The convincing version of this story often reaches whoever picks up the phone or opens the door.
• Cut back what people-search and directory sites publish about you. A leaked address and phone number become far more useful when they can be joined to relatives, employers and previous addresses. Those public listings, unlike the stolen file, can actually be removed. That is the lever you still have. The breach itself is not.