French sfr.fr Customers Targeted: 1,226 Passwords Leaked

French sfr.fr Customers Targeted in a 1,226-Record Stealer Log

On 23 June 2026, HEROIC analysts identified a stealer log uploaded to a Telegram channel containing 1,226 records tied to sfr.fr, the French telecom and internet provider. Each record pairs an email address with a plaintext password and the login URL where it was captured, all pulled from malware-infected devices rather than from any breach at SFR itself.

Why sfr.fr Customers in Particular Are at Risk

Because these accounts belong to customers of a major internet and telecom provider, they are often linked to billing information, phone numbers, and other personal details stored on the account. With 1,226 plaintext passwords now circulating, anyone reusing that password elsewhere is exposed to more than just their SFR account.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each sfr.fr account

Why This Targeted Group Faces Broader Consequences

Attackers who obtain telecom account credentials often attempt credential stuffing against banking and shopping sites, and can use account access to intercept verification codes or personal information tied to a phone plan. That combination raises the risk of account takeover, identity theft, and financial fraud for the customers affected.

How Telecom Customers End Up in a Stealer Log

Infostealer malware infects a device through pirated software, a cracked download, or a malicious attachment, then silently copies saved browser passwords, cookies, and autofill entries. Criminals sort the stolen data by the sites involved, in this case customers of sfr.fr, and share or sell the resulting log on Telegram.

Check If You Are Affected

If you are an sfr.fr customer, or have reused your SFR password elsewhere, check your exposure now. HEROIC's free breach scanner searches more than 400 billion breached and leaked records, including stealer logs like this one, to confirm whether your credentials were exposed.