Eurofiber confirms November 13 hack, data theft, and extortion attempt

Eurofiber has confirmed that on 13 November 2025 threat actors exploited a software vulnerability to breach its ticketing system and the ATE customer portal used by Eurofiber France and its regional brands, exfiltrating data and attempting extortion. The company says the breach affected only customers in France and its subsidiaries, with no impact on clients in Belgium, Germany, or the Netherlands, and that it promptly secured the platforms, patched the vulnerability, and is providing ongoing updates to customers.

It notes that the incident was reported to the CNIL and the ANSSI, and that a complaint for extortion was filed as part of its response. On 14 November 2025, postings on a cybercrime forum were found claiming the attackers had obtained sensitive materials, including internal keys and configurations, with one claim detailing a GLPI SQL injection used to pull around 10,000 bcrypt hashes over 10 days, while spinning up 20 EU VPS to speed the extraction, according to International Cyber Digest.

Eurofiber emphasises that the attack did not touch bank details or other critical data in its systems, and that services remained fully operational.