Bouygues Telecom discloses data breach affecting 6.4 million customers

Bouygues Telecom, one of France’s largest telecommunications providers, has confirmed a major data breach that compromised the personal information of approximately 6.4 million customers.

In a public statement and an FAQ published on its website, the company said the cyberattack occurred on Sunday, August 4, and involved unauthorized access to customer data. The breach did not impact network operations or service availability, but it exposed sensitive customer details, including contact information, contract data, civil status records, company information for business accounts, and International Bank Account Numbers (IBANs).

Bouygues Telecom emphasized that no credit card numbers or account passwords were compromised in the incident. Technical teams acted swiftly to contain the breach, blocking the attacker’s access and implementing additional security measures to prevent further intrusion.

“This situation was resolved as quickly as possible by Bouygues Telecom’s technical teams, and all necessary additional measures have been implemented,” the company said in a translated statement.

Internal investigations concluded that the attack was carried out by a known cybercriminal group that targeted specific internal resources. Authorities, including France’s National Cybersecurity Agency (ANSSI) and the data protection watchdog CNIL, were promptly notified. Under French law, the attacker could face up to five years in prison and a fine of €150,000 if identified and convicted.

Although the compromised IBANs cannot be used to initiate payments on their own, Bouygues Telecom is advising affected individuals to monitor their bank accounts closely for unauthorized transactions. Customers have been notified of the breach via SMS and email, and the company is warning them to remain vigilant against phishing scams and social engineering attempts. Specifically, Bouygues urges customers not to share sensitive information with callers who reference personal data such as names or account numbers.

The incident follows a similar breach reported by Orange, another French telecom provider, just days earlier. On July 25, Orange confirmed a cyberattack that potentially involved customer data, though its investigation remains ongoing and no further updates have been issued.

These back-to-back attacks on French telecommunications firms echo a broader trend seen in recent months, including breaches targeting U.S.-based providers. Security researchers have attributed some of those attacks to state-sponsored groups, including China-linked hacking group Salt Typhoon.

Bouygues Telecom serves 14.5 million mobile subscribers in France and employs approximately 9,000 people. The company generated €56.8 billion ($66 billion) in annual revenue and is considered one of the pillars of France’s digital infrastructure.