Leak at Bouygues Telecom

On 6 August 2025, Bouygues Telecom — one of France's largest mobile and broadband operators — disclosed that it had been the victim of a cyberattack that gave an unauthorized third party access to personal data tied to 6.4 million customer accounts. The intrusion was detected on 4 August 2025, and the company notified the affected individuals by email or SMS.

The exposed information varied by customer but covered contact details, contractual data, civil-status information (and company data for business customers), and bank account identifiers. Bouygues Telecom stressed that no bank card numbers and no account passwords were compromised in the breach.

Exposed data categories included:

• Contact details (name, address, email, phone)
• Contractual and subscription data
• Civil-status data (and company data for professional customers)
• IBANs (bank account numbers)

While an IBAN alone is not sufficient to initiate fraudulent transfers, when combined with a customer's name it can enable SEPA direct-debit fraud and highly convincing targeted phishing. Bouygues Telecom reported the incident to France's cybersecurity agency (ANSSI) and the data protection authority (CNIL) and filed a criminal complaint. The breach was one of several to hit French telecom operators in the preceding year, and affected customers were advised to monitor their bank statements and stay alert to phishing attempts.