Bouygues Telecom S.A.

Bouygues Telecom's August 2025 cyberattack is a French telecom customer-data exposure event, not a generic breach count. The operator said unauthorized access affected personal data tied to 6.4 million customer accounts, and that CNIL and judicial authorities were notified. The exposed surface was subscription data: contact details, contract information, civil-status or company data and IBANs, while Bouygues said passwords and card numbers were not impacted. The intelligence signal is the control surface around telecom customer-account stores, IBAN handling, breach notification, customer warning and fraud follow-through.

Bouygues Telecom disclosed the breach on August 6, 2025 after detecting the cyberattack on August 4. The company said a third party gained unauthorized access to personal information associated with 6.4 million customer accounts. Bouygues Telecom is a major French fixed and mobile operator, so the affected dataset sits inside a recurring national telecom dependency: customer identity, billing and service-contract records.

The operating surface is specific. Bouygues Telecom's FAQ identifies contact details, contract data, civil-status data or company data for professional customers, and IBANs as the targeted categories. It also says Bouygues Telecom account passwords and customer card numbers were not impacted. That boundary matters because the likely exposure mechanism is not payment-card compromise; it is account-context leakage that can make fraudulent calls, SMS, emails and fake bank-advisor scripts more convincing.

The institutional path is also documented. Bouygues Telecom said it notified CNIL and filed a complaint with judicial authorities. CNIL's telecom notification framework states that public electronic-communications providers must notify personal-data breaches to CNIL and, in some cases, affected people. That makes CNIL the relevant regulatory control point, but the public record does not show a CNIL sanction or final enforcement finding against Bouygues Telecom.

The event should be tracked for containment detail, customer fraud outcomes, CNIL follow-up, possible judicial findings and whether repeated attacks against French telecom operators lead to stronger expectations around account-store segmentation, IBAN minimization, customer notification and post-breach monitoring. The public record establishes the disclosure, affected-account count and data categories; it does not establish attacker identity, dwell time, data misuse, ransomware involvement or a final regulator decision.