Your SFR WiFi Login May Be Exposed: 202 Accounts Leaked Online

HEROIC analysts identified a combolist file tied to wifi.sfr.fr uploaded to a Telegram channel in May 2026. The domain belongs to SFR's public WiFi hotspot login service, a French internet provider. The file contains 202 records pairing email addresses with plaintext passwords and the URLs those accounts connect to. Why This Is Dangerous: Because the passwords in this file are plaintext, anyone who downloads it can log in with these credentials right away, no cracking required. WiFi hotspot accounts are often tied to a broader customer account, so a working login could expose more than just internet access. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to wifi.sfr.fr accounts Why This Matters: If any of these 202 accounts still use the leaked password, an attacker could log in to the customer's SFR account, view personal and billing details, or attempt the same email and password combination on other services the person uses. Password reuse is what turns a small leak like this into a much bigger risk, since one working combination can unlock email, banking, or social accounts far beyond the original service. How a Combolist Like This Works: A combolist pairs usernames or emails with passwords, typically compiled from smaller breaches, phishing pages, or stealer logs and grouped around a specific site, in this case wifi.sfr.fr. These files circulate on Telegram channels where attackers trade or sell them, then run each pair against the real login page to confirm which credentials still work before using or reselling the verified list. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address appears in this leak or any other. If your SFR wifi login shows up here, change the password immediately and update it anywhere else you may have reused it.