ISP Breach Exposes 4 Million Records in 2026

21 September 2026

Regional carrier DB Telecom confirms data theft, lawmakers track origins of leak

In April 2026, DB Telecom, a Marseille-based IP-telephony operator on the Orange/Or-Tel network, confirmed a major data breach that exposed more than 4 million customer records. The Regional Telecom Regie quickly launched an investigation after a threat actor put roughly 41,470 customer records up for sale on illicit forums around 10 April. The exposed database included names, phone numbers, email addresses, plaintext passwords, and internal emails from the French ISP.

What Happened

The scale of the breach remains unclear, but DB Telecom's initial examination found evidence of unauthorized access dating back to the final weeks of 2025. An internal investigation confirmed the intrusion and determined that a threat actor was responsible. DB Telecom has not yet disclosed the timeline of identification, but the first reports of leaked records emerged in early April.

On 12 April, DB Telecom released a statement confirming the breach and announcing an internal investigation. "We have launched a thorough investigation and are working with external cybersecurity experts and law enforcement to determine the full scope of the incident," the company said in a statement. DB Telecom declined to provide further details, saying only that affected customers would be notified.

What Data Was Exposed

The leaked data reportedly includes 2,835,372 records of customer information, including names, email addresses, and phone numbers, according to cyber threat data aggregator CyberBreaches. The largest category of the exposed emails and phone numbers belong to residential customers, but millions of business and enterprise-level records are also compromised, the disclosure claims.

Anchoring the database is a list of 127,035 complete internal email addresses belonging to DB Telecom staff, managers, and on-site contractors. The exposed email list spans across all departments and appears to be updated through the laugh of 2024, at least. According to threat researchers, thousands of DB Telecom staff were using functionally identical passwords across email and telephony accounts, opening up massive opportunities for credential stuffing.

In early 2026, Russian-language cyber-underworld forums began flooded with reports and inquiries about the scope of available DB Telecom customer and employee records. The threat actors were willing to explain that only base-level and unverified information was being sold and distributed. The bulk of the data leak likely isn't valued at more than tens of thousands of U.S. dollars, although the group behind the access denied holding onto any specific telecom records—such as voice-language databases, active voice/sms logs, or their associated keys.

Significance of the Breach

A leaked breach of that size may affect hundreds of thousands of US users, according to early estimates. Cross-referencing the exposed contact details with leaked records from Datacow, a procedurally unsafe data site, threat researchers from Socradar were able to link more than 575,000 unique U.S. phone numbers to the DB Telecom breach. The majority came from Ohio and Georgia, which are big for DB Telecom resellers.

In 2026, this isn't the only data breach to affect major ISPs. Just one month earlier, Brightspeed announced that they were actively investigating a data breach that may impact more than 1 million U.S. customers. In the last 36 months, several other incidents have affected France-based ISPs, with nearly 19 million subscribers affected by a data breach at Free, a French telecommunications subsidiary of the Iliad Group.

In August 2025, Australian ISP iiNet suffered a breach involving over 14,000 user credentials. Four months later, in Japan, KDDI Corporation's shared email platform was compromised, potentially impacting up to 14.22 million records. These incidents demonstrate a growing trend of ISP breaches, with the DB Telecom incident being among the top for scale and affected customers.

Regulatory Response

Regulators are already probing the DB Telecom intrusion. On 14 April, Carlos Rufino, a telecommunications official with the U.S. Federal Trade Commission, said the agency was working to determine the extent of the breach and its impact on consumers. "The FTC takes data breaches involving the telecommunications industry very seriously," Rufino said. "We will continue to investigate thoroughly and take appropriate steps to protect consumers."

Spanish telecom and internet regulators have also launched probes, and an investigation by the Luxembourg Insurance Regulation and Supervision Bureau remains open. U.S. Senator Ron Wyden was among the first to raise concerns, writing in a statement, "Data breaches at telecommunications companies are becoming all too common, and the information they hold is among the most sensitive. These companies must be held accountable for protecting consumers, and regulators must take decisive action."

Customer Impact and Response

DB Telecom is urging customers to take prescribed security precautions, including password changes and multi-factor authentication. U.S. customers who receive notification of exposure are advised to reset their passwords and monitor their accounts for suspicious activity.

The ISP has also offered free credit monitoring and identity theft protection to affected customers. "We understand the frustration and concern this incident may cause, and we deeply regret any inconvenience this may cause," DB Telecom stated.

As of 2026, Company didn't provide an exact tally of affected customers. The organization confirmed the accuracy of the published data breach data, but claims that the overall count of impacted clients or subscribers is much lower than the records published.

The investigation is ongoing, and DB Telecom has not attributed the breach to any specific group or nationwide government actors.

Several additional details have come to light in the past several days. The cause and timeline of the incident are still in question, and investigations are ongoing.