SFR: Customer Data Breach, Including Bank Details

The operator SFR has experienced a customer data breach, including IBANs, the group confirmed on Friday to AFP after letters addressed to subscribers were circulated.

"On September 3rd, SFR detected a security incident involving a customer order management tool," the operator stated in a standard letter reviewed by AFP, which was sent to the affected customers.

According to the letters, the accessible data included "first and last names, contact details provided at the time of the order (phone number, email, postal address, and delivery address if applicable), contract data (subscribed offer, order contents), as well as the device and SIM card identification numbers (for mobile device orders)."

For a portion of the customers, though SFR did not disclose the proportion, the data breach also included IBANs.

When questioned, the group did not specify the total number of affected customers but confirmed that both regular subscribers and "Red by SFR" subscribers were impacted.

SFR announced that it had filed a complaint with the Public Prosecutor and notified the French Data Protection Authority (CNIL) of this data breach, a mandatory measure since 2018.