Bouygues Telecom has reported a security breach that exposed the personal and financial information of 6.4 million customers. The leaked data includes names, contact details, subscription information, and bank account identifiers (IBANs). Passwords and credit card numbers were not exposed.
The breach was discovered on August 4 by the company’s internal security team, which blocked access and began investigating. Bouygues said its mobile, broadband, and IPTV services were not disrupted, and customer-facing systems remain operational.
Customers whose data was compromised are being notified by email and SMS. The company is urging them to stay alert for potential fraud, especially suspicious calls, messages, or emails. With sufficient personal and bank details, attackers may attempt impersonation scams, pretending to be from Bouygues, a different bank, or another service provider, the company says.
IBANs alone can’t be used to directly withdraw money, but when combined with other information, they can be used in social engineering schemes. Scammers may try to trick people into giving away login credentials or authorising transactions.
The attacker gained access to a limited but sensitive dataset including customer contact details, civil status or business identity, and subscription records.
The company filed a formal complaint with law enforcement authorities and notified France’s data protection authority, CNIL, and ANSSI, the national cybersecurity agency. Under French law, the attacker could face up to five years in prison and a fine of €150,000.
CNIL often oversees how companies respond to breaches, including whether they took adequate steps to protect data before the incident, how quickly they responded, and how well they communicate with affected individuals. ANSSI typically handles broader cybersecurity risks, especially if critical infrastructure or national services are involved.
Bouygues Telecom is one of France’s largest telecom operators, serving more than 14 million mobile subscribers and millions more through its broadband and IPTV services. It competes directly with companies like Orange and SFR and maintains an extensive cell network in the country.
So far, Bouygues hasn’t provided details about how the breach occurred or who may be behind it. While its internal teams acted quickly to shut down the attack, the firm acknowledged that leaked data may still be misused.
The incident comes just days after Orange France reported a cyberattack that disrupted its business platforms. In that case, no customer data was stolen, but the back-to-back timing of both events has raised concerns about whether French telecom providers are being targeted deliberately.
The incidents are not isolated. In recent years, telecom companies in other countries have also faced coordinated attacks, with adding to growing concerns around data privacy. Incidents like this add pressure on telecoms to strengthen their defences and improve how they detect and respond to breaches.
Bouygues is asking affected customers to keep an eye on their bank accounts and report any suspicious activity. The company is also reminding users not to share sensitive information over phone or email, especially if the request seems unusual or unexpected.
While Bouygues says there is no impact to its services, the breach highlights how personal data – especially when tied to financial information – can be used to target individuals. The company says it continues to monitor the situation closely.
(Photo by Fili Santillán)
See also: Europe must adapt to Russia’s hybrid cyber war
Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
