Eurofiber France warns partners that their IBANs may have been accessed

The email subject line is plain: “Information concerning a security incident.” Eurofiber France's partners received it this week. The fiber-optic infrastructure operator, which mainly serves businesses, reports a new incident in it. The specialist sites Cyberattaque.org and Fuites Infos revealed its contents on October 17.

According to the email, Eurofiber France detected an incident on October 14 on the infrastructure that hosts Waza, its partner platform. Initial investigations indicate that an unauthorized third party may have accessed some data. The company does not yet know whether the data was only viewed or was also copied.

What data is affected?

According to the email cited by Cyberattaque.org, the data includes partners' last names, first names and business email addresses, and “in some cases” bank details in IBAN format. Fuites Infos adds that some data belonging to these partners' customers could also be affected, without specifying what kind.

Eurofiber France gives no figures: neither the number of partners affected nor the volume of data. It says it secured the infrastructure as soon as the incident was detected and has seen no further access since. The CNIL (the French data protection authority) has been notified. At this stage, no hacking group has claimed the attack.

The November 2025 precedent

This is not the first alert. On November 13, 2025, Eurofiber France discovered that its ticket management platform and the customer portal of its cloud business had been compromised. Its regional brands were also affected. According to BleepingComputer, the company said at the time that bank details were not involved. A hacker later tried to resell the data.

After that attack, the operator announced several measures: multifactor authentication, encryption of API tokens, key rotation, and IP address restrictions. According to Cyberattaque.org, no technical link has been established between the two incidents.

What to do if you are a partner or customer

No stolen password is needed to cause harm here. A name, a business address and an IBAN, tied to a real business relationship, are enough to build credible scams. As with the leak at the Bucharest Stock Exchange, the main risk is fraud, not the IBAN itself.

• Verify through another channel any request to change bank details that claims to come from Eurofiber or a partner: call back a number you already know, never the one in the message.
• Alert your accounting team: fake invoices and fake direct debit notices are the most likely scenarios.
• Monitor your statements for SEPA direct debits you did not authorize. They can be disputed with your bank.
• Be wary of calls from supposed technicians or advisers who already know your information.

It remains to be seen whether data was actually taken, and how many companies are affected. That is what Eurofiber will have to clarify for its partners in the coming weeks.