Eurofiber Breach Exposes Critical Infrastructure Data Across Europe – What You Need to Know

Eurofiber says a major breach has hit its GLPI IT service management platform, exposing sensitive data from thousands of client environments and potentially creating supply‑chain risks for connected organisations across Europe. The incident stems from claims by a threat actor known as ByteToBreach, who says they have exfiltrated a full copy of Eurofiber’s GLPI database, including credentials, configuration files and internal communications.

SOCRadar first detected the claim on 14 November 2025 via an underground post, according to the attacker’s claims as reported on International Cyber Digest. The data reportedly exposed includes SSH private keys, VPN configurations, API keys and cloud tokens, along with source code, tickets and internal messages, enabling direct production access and lateral movement if used.

More than 3,600 organisations appear on the affected domain list, among them Airbus, several French government ministries, Thales, Orange, Engie, TotalEnergies, and others across defence, telecoms, energy and retail. Organisations are advised to rotate SSH keys, replace VPN configurations, regenerate API keys and tokens, review authentication logs, and conduct endpoint and network scans.