La Poste Mobile, a French mobile virtual network operator owned by La Poste and SFR, was hit by a LockBit 3.0 ransomware attack on July 4, 2022. The incident affected the company's administrative and management systems rather than its core network, but it forced the customer-facing website and account portal offline for roughly ten days while the company contained the intrusion and engaged external responders.\n\nLockBit listed La Poste Mobile on its public extortion site and, after the company declined to pay, began publishing stolen data in mid-July 2022. The dump included customer files for both mobile and home-internet (Box) subscribers. The exposed data covered approximately 1.3 million customer records, with around 533,000 unique email addresses among them. Fields included names, physical addresses, phone numbers, dates of birth, gender, and banking information including account numbers, alongside payment-card data in at least some records.\n\nThe exposure carries higher risk than a typical contact-data breach. Bank account numbers, names, and dates of birth are a strong base for SEPA-area direct-debit fraud and identity-verification attacks at French financial services. SIM-swap risk is elevated because attackers hold both customer phone numbers and matching personal identifiers. Affected La Poste Mobile customers should treat their phone number as a higher-risk authentication channel, monitor bank statements closely for unauthorized direct debits, and remain alert to fraud calls or messages referencing their account.

Telecom providers collect subscriber identity, phone numbers, billing records, service addresses, device data, and account-management information across mobile-service operations.

La Poste Mobile took its website and customer portal offline for an extended period following the July 2022 attack and rebuilt access controls before bringing services back online. The incident triggered required notifications under the EU's General Data Protection Regulation. The company has not been publicly tied to a further large-scale breach disclosure since then. Both the LockBit ransomware operation responsible for the 2022 attack and the broader French telecom ecosystem have continued to face ransomware activity, although LockBit itself was significantly disrupted by an international law-enforcement takedown in early 2024.