Bouygues Telecom, France's third-largest mobile network operator, detected unauthorized access to customer data on August 4, 2025 and disclosed the incident publicly on August 6. The company described the intrusion as the work of a 'known cybercriminal group' that targeted specific internal resources, blocked the attacker's access, and reported the matter to French data-protection regulator CNIL and national cybersecurity agency ANSSI. Bouygues also filed a criminal complaint with judicial authorities.\n\nThe breach affected approximately 6.4 million customer records, with around 5.7 million unique email addresses among them. Compromised fields included names, physical addresses, phone numbers, dates of birth, email addresses, and International Bank Account Numbers (IBANs) used for direct-debit billing. Both individual consumer accounts and professional business accounts were affected. Bouygues confirmed that no payment-card data and no Bouygues account passwords were compromised. The breach pattern echoes earlier incidents at French telecom peers Free and La Poste Mobile, both of which also exposed customer banking data.\n\nFor affected customers, the practical risk is concentrated in two areas. The combination of name, address, date of birth, and phone number creates a strong base for targeted phishing and SIM-swap impersonation. The IBAN exposure raises the prospect of unauthorized SEPA direct-debit attempts. While SEPA rules allow refund of unauthorized direct debits within 13 months of the transaction, attempted fraud still creates short-term cash-flow disruption and account-management burden. Affected customers should monitor bank statements closely, apply direct-debit blocks or whitelists where their bank offers them, and remain alert to messages purporting to be from Bouygues, banks, or government services that reference their account or contract details.

Telecommunications providers collect subscriber identity, phone numbers, service addresses, billing records, device data, and account-management information across mobile and broadband networks.

Bouygues Telecom continues to operate normally following the August 2025 incident, which it described as a contained intrusion that did not affect customer services or networks. The company notified the French data-protection regulator CNIL and the National Cybersecurity Agency ANSSI, filed a criminal complaint with judicial authorities, and pushed direct customer notifications via SMS and email. Bouygues attributed the attack to a 'known cybercriminal group' but has not publicly named the actor. The incident sits in a broader pattern of cyberattacks against European telecommunications operators through 2025, including a separate breach disclosed by Orange France a week earlier on July 25, 2025.