Eurofiber France

Dated facts in the public record

1. 6 November 2025

   Earliest traces identified later: blind SQL injection targeting the user database.

2. 10 November 2025

   Exfiltration intensifies through REST API calls targeting tickets and documents.

3. 13 November 2025

   Monitoring detects abnormal activity at 14:49. Crisis response begins. Eurofiber reports the vulnerability patched and the affected server isolated by 18:15.

How it happened

Eurofiber states that a vulnerability in the ticketing software, known in the security community under a CVE reference, permitted SQL injection and API-based data extraction. A customised version in Eurofiber’s environment had not been identified by the vendor as vulnerable. The company did not name the product or the CVE identifier in its own postmortem; this record does not treat a later product name as confirmed.

What was exposed

Identification data such as name, first name, email, hashed password and, where present, phone or profile information. Ticket content, ticket exchanges and some attachments were also affected. Eurofiber said only about 2 percent of the oldest tickets had attachments in the affected category. The scope included Eurofiber France and regional brands Eurafibre, FullSave, Netiwan and Avelia, plus the Eurofiber Cloud Infra France portal. Customers outside France were reported unaffected.

What was not in scope

Eurofiber said banking or critical data were not compromised. It also said the integrity and availability of the underlying network and cloud services were not compromised by the attack.

What it meant in practice

The direct service impact was limited, but the downstream intelligence value is significant. A supplier’s support tickets can expose hostnames, architecture details, troubleshooting logs, screenshots and attachments about many organisations at once. This is a supplier-exposure case even without a large public victim count.

What was done next

Eurofiber activated a crisis cell with its SOC provider, preserved forensic evidence, isolated and patched the vulnerable service, rotated passwords and API keys, tightened IP restrictions, notified customers and authorities, and introduced stronger authentication and API-token protection. The company also reported an extortion attempt in its follow-up.

What later reporting changed

The postmortem justifies treating the exploitation mechanism — SQL injection and REST-API exfiltration — as disclosed, while still leaving the attacker’s identity and any later product name unconfirmed by Eurofiber.

In their words

• The first traces of the attack date back to November 6

  Eurofiber France post-incident review

• SQL injection

  Original injection SQL

  Eurofiber France

What does this mean?

Exfiltration

Copying data out of a system to somewhere the attacker controls.

SQL injection

Slipping database commands into an ordinary web form or link, so the site runs them and returns data it should not.

Supplier or supply-chain exposure

Data leaks through a company that works for the organisation, rather than from the organisation itself.