Bouygues Telecom 2025 Data Breach
ObscureIQ Breach Intelligence
High SeverityWebsite / service breach
Bouygues Telecom French Carrier Breach (2025): 5.7 Million Customer Records Including IBAN Bank Account Numbers Exposed
French telecommunications provider.
Verified by ObscureIQ Intelligence
77/100Breach Risk Index
28Data Value
40Market Recency
215dSince Breach
Breach Intelligence Summary
Entity: Bouygues Telecom · Actor: Unspecified "known cybercriminal group" (per Bouygues; not publicly named) · Sources: 3 references
Attack: Misconfiguration
Profile: Company · Telecommunications services · Mobile and broadband provider · France
Timeline: Breach (2025-08-04) · Indexed (Sep 24, 2025) · Year (2025)
Exposure: 5.7M records · 6 fields: Bank Account Number, Date of Birth, Email Address, Full Name, Phone Number, Physical Address
Status: Confirmed
Executive Summary
Bouygues Telecom, France's third-largest mobile network operator, detected unauthorized access to customer data on August 4, 2025 and disclosed the incident publicly on August 6. The company described the intrusion as the work of a 'known cybercriminal group' that targeted specific internal resources, blocked the attacker's access, and reported the matter to French data-protection regulator CNIL and national cybersecurity agency ANSSI. Bouygues also filed a criminal complaint with judicial authorities.\n\nThe breach affected approximately 6.4 million customer records, with around 5.7 million unique email addresses among them. Compromised fields included names, physical addresses, phone numbers, dates of birth, email addresses, and International Bank Account Numbers (IBANs) used for direct-debit billing. Both individual consumer accounts and professional business accounts were affected. Bouygues confirmed that no payment-card data and no Bouygues account passwords were compromised. The breach pattern echoes earlier incidents at French telecom peers Free and La Poste Mobile, both of which also exposed customer banking data.\n\nFor affected customers, the practical risk is concentrated in two areas. The combination of name, address, date of birth, and phone number creates a strong base for targeted phishing and SIM-swap impersonation. The IBAN exposure raises the prospect of unauthorized SEPA direct-debit attempts. While SEPA rules allow refund of unauthorized direct debits within 13 months of the transaction, attempted fraud still creates short-term cash-flow disruption and account-management burden. Affected customers should monitor bank statements closely, apply direct-debit blocks or whitelists where their bank offers them, and remain alert to messages purporting to be from Bouygues, banks, or government services that reference their account or contract details.
ObscureIQ assessment: Severe risk of SIM swap attacks, phishing, account takeover, and identity theft. Telecom account access can also enable compromise of unrelated services through phone-based verification.
Breach Impact
The institutional impact on Bouygues Telecom is meaningful but contained relative to the breadth of customer exposure. The company faces ongoing CNIL oversight under GDPR, which carries potential fines of up to 4 percent of global annual revenue for serious failings, although French regulators historically calibrate penalties to factual specifics. Bouygues bore the operational cost of customer notification at scale, public crisis communications, and a still-running judicial investigation. Reputationally, the breach added pressure to a French telecom sector already shaken by the Orange incident days earlier and a series of prior breaches at Free and La Poste Mobile, all of which exposed bank account details.
About Bouygues Telecom
Bouygues Telecom is the third-largest mobile network operator in France, headquartered in Paris and part of the Bouygues industrial group founded in 1994. The company offers mobile telephony, broadband internet, fiber, and IPTV services to roughly 27 million customers, supported by approximately 9,000 employees and annual revenue near €5.7 billion. Customer-facing systems hold subscriber identity, contractual records, billing data, and direct-debit IBAN information used for monthly service charges. Bouygues serves both individual consumers and professional accounts, and its IBAN-on-file model for billing makes bank account numbers a routine element of the customer data set.
Why They Hold Your Data
Telecommunications providers collect subscriber identity, phone numbers, service addresses, billing records, device data, and account-management information across mobile and broadband networks.
Recent Developments
Bouygues Telecom continues to operate normally following the August 2025 incident, which it described as a contained intrusion that did not affect customer services or networks. The company notified the French data-protection regulator CNIL and the National Cybersecurity Agency ANSSI, filed a criminal complaint with judicial authorities, and pushed direct customer notifications via SMS and email. Bouygues attributed the attack to a 'known cybercriminal group' but has not publicly named the actor. The incident sits in a broader pattern of cyberattacks against European telecommunications operators through 2025, including a separate breach disclosed by Orange France a week earlier on July 25, 2025.
Data Points Exposed
6 verified field types
Bank Account Number Critical
Date of Birth High
Email Address
Full Name High
Phone Number
Physical Address High
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:Critical
Primary downstream threats:
- Financial fraud using exposed financial profile data
- Identity verification bypass using name + date of birth combination
- SIM swap attacks where phone numbers are present
- Targeted phishing campaigns using exposed email addresses
- Doxxing risk from physical address exposure
Threat vectors:
- ACH fraud & unauthorized transfers
- Identity verification bypass
- Phishing, credential stuffing & account takeover
- Name-based social engineering
- SIM swapping, vishing & SMS phishing
- Physical stalking, mail fraud & identity verification
Threat Actor: Unspecified "known cybercriminal group" (per Bouygues; not publicly named)
Unspecified "known cybercriminal group" (per Bouygues; not publicly named)
Misconfiguration
Attribution and method are based on available breach intelligence. Reported attack vector: Misconfiguration.
Recommended Actions
If you believe your information may be included:
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the Bouygues Telecom breach?▾
Bouygues Telecom, France's third-largest mobile network operator, detected unauthorized access to customer data on August 4, 2025 and disclosed the incident publicly on August 6. The company described the intrusion as the work of a 'known cybercriminal group' that targeted specific internal…
What data was exposed?▾
Verified fields include Bank Account Number, Date of Birth, Email Address, Full Name, Phone Number, Physical Address.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
Cross-source
LeakCheck.io
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation