Bouygues Telecom data breach: what happened and what to do

What happened

Bouygues Telecom, one of France's main mobile and internet providers, said it was the victim of a cyberattack on Sunday, August 4, 2025. The company announced it in a press release dated August 6. It blocked the attacker's access, added monitoring and security measures, told France's data protection authority (the CNIL) and filed a complaint with the judicial authorities. Early statements said the attack was carried out by a "known cybercriminal group", but no group was named in the sources.

Bouygues Telecom said personal data from 6.4 million customer accounts was accessed. Have I Been Pwned added the incident to its database in September 2025. Its entry says the breach exposed almost 6.4 million customer records, including 5,685,771 unique email addresses.

What was exposed

According to the company's own FAQ, the data included contact details, contract information, civil status data such as date of birth, company details for business customers and IBANs. Have I Been Pwned lists names, email addresses, phone numbers, physical addresses, dates of birth and bank account numbers. Passwords and bank card numbers were not affected, the company said.

What it means for you

Contact details plus a date of birth and a bank account number are the raw material for convincing fraud. Expect phishing emails and texts that look like they come from Bouygues Telecom or your bank, mention real contract details and push you to "confirm" a payment or update your banking information. Bouygues said the leaked IBANs are not enough to start transfers on their own, but it still advises affected customers to check their debits regularly. A leaked phone number also makes it easier for someone to try a SIM swap, where a criminal tricks a provider into moving your number to their own SIM.

Dates of birth can't be changed, so they stay useful to scammers for a long time. That's why the sensible response is to tighten what you can control: verification on your phone account, alerts on your bank account and suspicion of any message that quotes your details.

The company's response

Bouygues Telecom notified affected customers by SMS or email. It also published a customer FAQ explaining what categories of data were involved and warning about phishing. If you were a customer in 2025 and didn't get a message, check your spam folder, then ask the company directly through its official site or app, not through a link in a message.

What Serus does here

You can't delete breach data from the places it spreads, so the useful move is to know early when your details show up somewhere new. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you, so you can act on the new exposure.