{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"eurofiber","date":"2025-11-13","year":2025,"org":"Eurofiber France","domain":"eurofiber.com","kind":"company","sector":"Telecom / cloud supplier","sectorLabel":"Telecom / cloud supplier","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Customer scope not expressed as a verified person count","data":"Identification data, hashed passwords, ticket content and some attachments. Banking or critical data and network/cloud integrity were not compromised, Eurofiber said.","method":"Blind SQL injection against the user database, then REST-API exfiltration of tickets and documents.","risk":"Supplier ticketing data can expose configuration and support history about many downstream organisations.","confidence":"Official company post-incident disclosure","sourceName":"Eurofiber France","sourceId":"eurofiber","sourceUrl":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees","sourceIds":["eurofiberInitial","eurofiber","eurofiberCloud"],"lastResearched":"2026-08-16","url":"/incident/eurofiber","detail":{"lead":"Eurofiber France published a detailed postmortem of an incident affecting its customer ticketing platform for Eurofiber France and regional brands, plus the ATE / Eurofiber Cloud Infra France customer portal. The company traced the first activity to 6 November 2025, when the attacker used blind SQL injection against the user database. From 10 November, exfiltration intensified through REST API calls targeting tickets and documents. Monitoring detected anomalies on 13 November at 14:49.","timeline":[{"date":"2025-11-06","label":"Earliest traces identified later: blind SQL injection targeting the user database."},{"date":"2025-11-10","label":"Exfiltration intensifies through REST API calls targeting tickets and documents."},{"date":"2025-11-13","label":"Monitoring detects abnormal activity at 14:49. Crisis response begins. Eurofiber reports the vulnerability patched and the affected server isolated by 18:15."}],"how":"Eurofiber states that a vulnerability in the ticketing software, known in the security community under a CVE reference, permitted SQL injection and API-based data extraction. A customised version in Eurofiber’s environment had not been identified by the vendor as vulnerable. The company did not name the product or the CVE identifier in its own postmortem; this record does not treat a later product name as confirmed.","taken":"Identification data such as name, first name, email, hashed password and, where present, phone or profile information. Ticket content, ticket exchanges and some attachments were also affected. Eurofiber said only about 2 percent of the oldest tickets had attachments in the affected category. The scope included Eurofiber France and regional brands Eurafibre, FullSave, Netiwan and Avelia, plus the Eurofiber Cloud Infra France portal. Customers outside France were reported unaffected.","notTaken":"Eurofiber said banking or critical data were not compromised. It also said the integrity and availability of the underlying network and cloud services were not compromised by the attack.","impact":"The direct service impact was limited, but the downstream intelligence value is significant. A supplier’s support tickets can expose hostnames, architecture details, troubleshooting logs, screenshots and attachments about many organisations at once. This is a supplier-exposure case even without a large public victim count.","response":"Eurofiber activated a crisis cell with its SOC provider, preserved forensic evidence, isolated and patched the vulnerable service, rotated passwords and API keys, tightened IP restrictions, notified customers and authorities, and introduced stronger authentication and API-token protection. The company also reported an extortion attempt in its follow-up.","methodDisclosure":"disclosed","revision":"The postmortem justifies treating the exploitation mechanism — SQL injection and REST-API exfiltration — as disclosed, while still leaving the attacker’s identity and any later product name unconfirmed by Eurofiber.","quotes":[{"text":"The first traces of the attack date back to November 6","original":"The first traces of the attack date back to November 6","originalLang":"en","attribution":"Eurofiber France post-incident review","sourceId":"eurofiber"},{"text":"SQL injection","original":"injection SQL","originalLang":"fr","attribution":"Eurofiber France","sourceId":"eurofiber"}]}},"source":{"id":"eurofiberInitial","name":"Eurofiber France — 13 November incident announcement","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-chez-eurofiber-france","publisher":"Eurofiber France","kind":"primary","published":"2025-11-13"},"sources":[{"id":"eurofiberInitial","name":"Eurofiber France — 13 November incident announcement","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-chez-eurofiber-france","publisher":"Eurofiber France","kind":"primary","published":"2025-11-13"},{"id":"eurofiber","name":"Eurofiber France - November 2025 incident review","url":"https://www.eurofiber.com/fr-fr/actualites/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees","publisher":"Eurofiber France","kind":"primary","published":"2025-12-15"},{"id":"eurofiberCloud","name":"Eurofiber Cloud Infra — November incident review","url":"https://eurofibercloudinfra.fr/2025/12/22/incident-de-cybersecurite-du-13-novembre-enseignements-et-actions-engagees/","publisher":"Eurofiber Cloud Infra","kind":"primary","published":"2025-12-22"}]}