Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Eurofiber France detected a cyberattack on November 13, 2025, in which an attacker exploited a software vulnerability and exfiltrated data from its French ticket-management platform and the ATE customer portal used by Eurofiber Cloud Infra France. Eurofiber said the incident affected its French operations and named regional brands, not customers using separate platforms in Belgium, Germany, or the Netherlands.
The company said services stayed operational, banking details and critical data held in other systems were not affected, and it reported the incident to France’s CNIL and ANSSI. SecurityWeek and SOCRadar published additional claims about credentials, keys, configurations and other material, but Eurofiber has not publicly confirmed that complete list.
What happened in the Eurofiber France breach?
Eurofiber’s published timeline is:
- November 13, 2025: Eurofiber France detected the incident.
- November 16: Eurofiber published its incident notice.
- November 18: SecurityWeek reported that data had been exfiltrated and that Eurofiber had filed an extortion complaint.
- November 19: SOCRadar published further analysis containing attacker claims and dark-web reporting.
Eurofiber described the initial access only as exploitation of a software vulnerability. The company did not identify the vulnerability, a CVE, the affected software version, or the attack technique. The verified facts establish data theft and an extortion report, not ransomware encryption or a reported outage.
Sources: Eurofiber’s incident notice, SecurityWeek, and SOCRadar.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which systems and brands were involved?
Eurofiber identified two affected customer-facing systems:
- Its ticket-management platform used by Eurofiber France and French regional brands.
- The ATE customer portal operated by Eurofiber Cloud Infra France.
The named regional brands are Eurafibre, FullSave, Netiwan and Avelia. Eurofiber’s notice does not describe a compromise of the fiber-optic network itself. It says the affected services remained operational, so this was a breach of supporting IT and customer-management systems rather than a reported network shutdown.
What data was confirmed stolen?
Eurofiber confirmed that data associated with the affected platforms was exfiltrated, but it did not publish a detailed inventory of records or the number of affected customers or individuals.
The company said banking details and critical data stored in other systems were not affected. That is a limited exclusion; it does not establish that no personal information, operational details or authentication-related material was present in the compromised platforms.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What third parties allege
SecurityWeek, citing SOCRadar, reported allegations that a compromised GLPI service-management environment contained support tickets, internal messages, configuration files, VPN configurations, credentials, API keys, tokens, SQL backups, source code, screenshots and internal documents. The same reporting attributed a claim of roughly 10,000 password hashes to the actor or related sources.
SOCRadar separately described alleged SSH keys, cloud tokens, network inventories, architecture details, ticket attachments, identity scans and documentation. These are third-party or attacker claims. Eurofiber has not publicly confirmed that the entire list was stolen, authentic or complete.
Was GLPI and SQL injection officially confirmed?
No. SecurityWeek described the ticketing environment as GLPI based on SOCRadar reporting. SOCRadar and the actor claiming responsibility alleged that a web-accessible GLPI instance was exploited through SQL injection and associated the system with versions 10.0.7 through 10.0.14.
Eurofiber’s official statement says only that a software vulnerability was exploited. It does not identify GLPI, SQL injection, or a version range. Those technical details should therefore be treated as reported allegations rather than an official finding.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Who claimed responsibility?
The name reported by SecurityWeek and SOCRadar is ByteToBreach. SOCRadar said the actor claimed to have obtained a copy of the GLPI database, sought private negotiation and later moved toward public-sale or extortion claims.
The actor’s identity, the authenticity of any samples and the completeness of the alleged files remain unverified in the cited material.
How many customers or organizations were affected?
Eurofiber did not publicly disclose a confirmed victim count in its incident notice. Published estimates are not interchangeable:
| Figure | How it was reported | What it does not prove |
|---|---|---|
| About 10,000 customers | SecurityWeek, citing SOCRadar-related reporting | Not an official Eurofiber total; may represent customer records or another database population. |
| More than 3,600 organizations | SOCRadar’s analysis | Not necessarily the number of customers, people or breached networks. |
The different figures may describe different populations, such as records, organizations represented in a database or domains visible in alleged material. Neither should be presented as a confirmed number of victims.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Did the breach affect Eurofiber customers outside France?
Eurofiber said the incident was limited to Eurofiber France, its French regional brands and ATE customers. It specifically said customers using separate platforms in Belgium, Germany and the Netherlands were not affected. It also described the impact on French indirect-sales and wholesale partners as very limited because most use separate systems.
That statement does not mean every French organization was exposed, nor does it establish that every non-French environment is risk-free under all circumstances. It identifies the platforms and geographic scope Eurofiber reported for this incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Were government or critical-infrastructure organizations hacked?
SecurityWeek reported that government entities appeared among potentially affected customers. SOCRadar listed alleged organizations connected with defense, telecommunications, energy, finance, healthcare, transportation, universities and retail.
Appearing in a customer, domain or data list is not proof that an organization’s own network or operational technology was breached. It may mean only that information about the organization was stored in the compromised service-management environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What did Eurofiber do?
According to Eurofiber, it:
- Secured the ticketing platform and ATE portal.
- Patched the exploited vulnerability and added further security measures.
- Notified customers and continued case-by-case updates.
- Reported the incident to CNIL and notified ANSSI.
- Filed an extortion report or complaint.
Eurofiber also said customer services remained fully operational throughout the incident.
What should an affected organization do now?
Organizations that used Eurofiber France, a named French brand or the ATE portal should treat the event as a potential credential and third-party-access risk until they receive customer-specific information.
- Obtain written confirmation. Contact Eurofiber through an authenticated channel and ask whether your account, tickets, attachments or portal data were involved.
- Inventory secrets. Identify passwords, API keys, tokens, SSH keys, VPN profiles, certificates and other secrets ever placed in tickets or attachments.
- Revoke and rotate. Replace those secrets, including apparently old ones, after checking application dependencies and preserving evidence.
- Review logs. Examine identity, VPN, cloud, API and privileged-access logs from November 13, 2025 onward for use of valid credentials or trusted Eurofiber-associated infrastructure.
- Assess information exposure. Look for internal hostnames, network diagrams, architecture documents, support procedures and other details that could enable targeted attacks.
- Coordinate internally. Involve incident response, legal, privacy and third-party-risk teams; preserve relevant logs and messages before making changes.
- Prepare for impersonation. Watch for phishing, fake support requests and extortion messages that use genuine ticket details.
- Ask about credential handling. Request confirmation of whether exposed credentials were hashed or salted and whether Eurofiber has invalidated or rotated them.
What remains unknown?
- The exact vulnerability and affected software version.
- The complete data inventory and number of affected customers or individuals.
- Whether the alleged credentials, keys, tokens or hashes were present and usable.
- The identity of ByteToBreach and the authenticity or completeness of alleged files.
- Whether any exposed secret was used in a downstream compromise.
- The status and outcome of the extortion attempt.
Bottom line
The Eurofiber France incident is best characterized as a French support-platform data breach involving exfiltration and extortion, with services continuing to operate. The strongest practical concern is possible exposure of credentials, keys, configurations and other third-party access information, but the most detailed technical and victim-count claims remain unconfirmed by Eurofiber. Affected organizations should seek account-specific confirmation, rotate every potentially exposed secret and investigate for downstream misuse.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
