4 August 2025
Bouygues Telecom
Company Telecommunications
Bouygues Telecom detected a cyberattack on 4 August 2025 and disclosed it two days later. The intrusion gave unauthorised access to personal data linked to 6.4 million customer accounts. That figure is a count of accounts, not necessarily 6.4 million unique people. Exposed fields included contact and civil-status information, contract information and banking identifiers such as BIC and IBAN. Bouygues said account passwords and payment-card numbers were not exposed.
Dated facts in the public record
Bouygues Telecom detects the attack; technical teams stop the unauthorised access.
Public disclosure: 6.4 million accounts; CNIL notified; complaint filed; customer notification begins.
Bouygues and Cybermalveillance.gouv.fr publish practical guidance on phishing, IBAN-related fraud and direct-debit disputes.
Cybermalveillance.gouv.fr updates its public advice page, preserving the 6.4 million-account scope and fraud guidance.
How it happened
Bouygues has described the event as unauthorised access and said its technical teams stopped it. The company has not publicly identified the initial access vector, a vulnerability, or an attacker.
What was exposed
Customer contact details, civil-status information, contract data, and BIC/IBAN. Cybermalveillance’s public summary also notes company identity and SIREN for relevant professional records. The 6.4 million figure is a count of customer accounts, not necessarily 6.4 million unique natural persons.
What was not in scope
Bouygues said customer account passwords and payment-card numbers were not exposed. Possession of an IBAN does not equal possession of bank credentials and does not automatically allow an attacker to move money.
What it meant in practice
The durable risk is targeted impersonation. A scammer who knows a victim’s operator, identity, contract context and IBAN can convincingly pose as a telecom employee, bank fraud unit, debt collector or payment intermediary. The exposure can also support fraudulent direct-debit attempts, although banks provide dispute mechanisms for unauthorised debits.
What was done next
Bouygues contained the unauthorised access, notified the CNIL, filed a criminal complaint and informed affected customers by email or SMS. Its FAQ explained what an IBAN can and cannot enable and referred customers to their bank when suspicious activity appears. Cybermalveillance.gouv.fr published public guidance designed to reduce follow-on fraud.
What later reporting changed
The confirmed 6.4 million number is customer accounts, and the presence of IBAN data should not be described as a compromise of online banking.
In their words
unauthorized access to certain personal data of 6.4 million customer accounts
Original accès non autorisé à certaines données personnelles de 6,4 millions de comptes clients
Bouygues Telecom
What does this mean?
- IBAN
- Your bank account number in international format. Knowing it lets a scammer sound convincing; it does not by itself let them take money.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.