Unverified claim — July 17, 2026: French monitors say cybercrime-forum actors are advertising a partial dump allegedly taken from SFR's internal NOVA fixed-line tooling—citing 2,104,093 rows of subscriber and equipment data. SFR had not confirmed this July listing at indexing time.
France's second-wave telecom breaches keep rhyming: Free, Bouygues, Orange affiliates, then SFR again. This particular post is a claim, not a CNIL-attested count.
What is being claimed
FrenchBreaches summarized a forum thread in which actors say they reached NOVA (Network Observation and Visual Analysis)—an internal portal described as holding fixed-broadband subscriber, fibre raccordement, and CPE/equipment views—starting around June 30, 2026. They say extraction was interrupted after detection, leaving a partial database of just over 2.1 million lines.
Screenshots circulating with the post appear to show customer PII (names, addresses, phones, customer IDs), subscription/line status fields, and technical identifiers (MAC, serial, GPON/ONT, IPv4/IPv6, OLT/port metadata).
What is not confirmed
Authenticity of the full corpus, the true unique-person count, and whether this dump is new versus recycled have not been independently verified in open sources reviewed for this entry. SFR's December 2025 customer notice about unauthorized access to a fixed-network intervention tool is a separate, company-confirmed incident—do not collapse the two without evidence.
Who should care
Current and recent SFR fixed-line / fibre subscribers in France. Even a partial CPE/topology leak is useful for targeted phishing ("your box needs a remote update") and SIM-swap pretexting.
What you should do
- Treat unsolicited calls or SMS about SFR network "technicians" or forced box resets as hostile until verified in the official app or by calling SFR on a known number.
- Enable account MFA where available; do not reuse your SFR password elsewhere.
- Watch for SIM-swap and fibre-line takeover social engineering.
- Canonical record: SFR NOVA forum claim on BreachHistory.
Sources: FrenchBreaches; @seblatombe reporting.