{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"bouygues","date":"2025-08-04","year":2025,"org":"Bouygues Telecom","domain":"bouyguestelecom.fr","kind":"company","sector":"Telecommunications","sectorLabel":"Telecommunications","severity":"critical","status":"confirmed","affected":6400000,"affectedLabel":"6.4 million customer accounts","data":"Identity, contact, contract data and BIC/IBAN on 6.4 million customer accounts — not a unique-person count. Passwords and cards not exposed.","method":"Unauthorised access; the initial access route has not been published.","risk":"Targeted impersonation and direct-debit scams. An IBAN is not online-banking access.","confidence":"Official company disclosure","sourceName":"Bouygues Telecom","sourceId":"bouygues","sourceUrl":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","sourceIds":["bouygues","bouyguesFaq","bouyguesCybermalveillance","bouyguesLemonde","bouyguesTechcrunch"],"lastResearched":"2026-08-16","url":"/incident/bouygues","detail":{"lead":"Bouygues Telecom detected a cyberattack on 4 August 2025 and disclosed it two days later. The intrusion gave unauthorised access to personal data linked to 6.4 million customer accounts. That figure is a count of accounts, not necessarily 6.4 million unique people. Exposed fields included contact and civil-status information, contract information and banking identifiers such as BIC and IBAN. Bouygues said account passwords and payment-card numbers were not exposed.","timeline":[{"date":"2025-08-04","label":"Bouygues Telecom detects the attack; technical teams stop the unauthorised access."},{"date":"2025-08-06","label":"Public disclosure: 6.4 million accounts; CNIL notified; complaint filed; customer notification begins."},{"date":"2025-08-13","label":"Bouygues and Cybermalveillance.gouv.fr publish practical guidance on phishing, IBAN-related fraud and direct-debit disputes."},{"date":"2026-02-04","label":"Cybermalveillance.gouv.fr updates its public advice page, preserving the 6.4 million-account scope and fraud guidance."}],"how":"Bouygues has described the event as unauthorised access and said its technical teams stopped it. The company has not publicly identified the initial access vector, a vulnerability, or an attacker.","taken":"Customer contact details, civil-status information, contract data, and BIC/IBAN. Cybermalveillance’s public summary also notes company identity and SIREN for relevant professional records. The 6.4 million figure is a count of customer accounts, not necessarily 6.4 million unique natural persons.","notTaken":"Bouygues said customer account passwords and payment-card numbers were not exposed. Possession of an IBAN does not equal possession of bank credentials and does not automatically allow an attacker to move money.","impact":"The durable risk is targeted impersonation. A scammer who knows a victim’s operator, identity, contract context and IBAN can convincingly pose as a telecom employee, bank fraud unit, debt collector or payment intermediary. The exposure can also support fraudulent direct-debit attempts, although banks provide dispute mechanisms for unauthorised debits.","response":"Bouygues contained the unauthorised access, notified the CNIL, filed a criminal complaint and informed affected customers by email or SMS. Its FAQ explained what an IBAN can and cannot enable and referred customers to their bank when suspicious activity appears. Cybermalveillance.gouv.fr published public guidance designed to reduce follow-on fraud.","methodDisclosure":"undisclosed","revision":"The confirmed 6.4 million number is customer accounts, and the presence of IBAN data should not be described as a compromise of online banking.","quotes":[{"text":"unauthorized access to certain personal data of 6.4 million customer accounts","original":"accès non autorisé à certaines données personnelles de 6,4 millions de comptes clients","originalLang":"fr","attribution":"Bouygues Telecom","sourceId":"bouygues"}]}},"source":{"id":"bouygues","name":"Bouygues Telecom - Cyberattack disclosure","url":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","publisher":"Bouygues Telecom","kind":"primary","published":"2025-08-06"},"sources":[{"id":"bouygues","name":"Bouygues Telecom - Cyberattack disclosure","url":"https://www.corporate.bouyguestelecom.fr/archives-communique-presse/bouygues-telecom-annonce-avoir-ete-victime-dune-cyberattaque/","publisher":"Bouygues Telecom","kind":"primary","published":"2025-08-06"},{"id":"bouyguesFaq","name":"Bouygues Telecom — customer FAQ on the August 2025 attack","url":"https://mag.bouyguestelecom.fr/cybersecurite/cyberattaque-fuite-de-donnees-questions/","publisher":"Bouygues Telecom","kind":"primary","published":"2025-08-13"},{"id":"bouyguesCybermalveillance","name":"Cybermalveillance.gouv.fr — Bouygues Telecom breach advice","url":"https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/violation-de-donnees-personnelles-bouygues-telecom-202508","publisher":"Cybermalveillance.gouv.fr","kind":"official","published":"2026-02-04"},{"id":"bouyguesLemonde","name":"Le Monde — Bouygues Telecom breach and the telecom sector","url":"https://www.lemonde.fr/economie/article/2025/08/07/le-piratage-d-ampleur-de-bouygues-telecom-confirme-que-les-operateurs-telecoms-sont-dans-le-viseur-des-cybercriminels_6627266_3234.html","publisher":"Le Monde","kind":"secondary","published":"2025-08-07"},{"id":"bouyguesTechcrunch","name":"TechCrunch — Bouygues Telecom data breach","url":"https://techcrunch.com/2025/08/07/data-breach-at-french-telecom-giant-bouygues-affects-millions-of-customers/","publisher":"TechCrunch","kind":"secondary","published":"2025-08-07"}]}