Pro-Russian hackers claim they stole data on 25,000 La Poste Mobile customers

On the morning of Wednesday, October 21, several pages of the La Poste Mobile website stopped responding. On Telegram, the pro-Russian collective NoName057(16) claimed an attack on the website, the customer portal and the SIM card activation platform. A few hours later, it added a much more serious claim: that it had obtained the data of 25,000 customers.

At this stage, nothing is confirmed. Neither La Poste Mobile nor Bouygues Telecom, the carrier's owner since November 2024, has publicly commented on a leak. According to Frandroid, one of its editors did find that some pages were inaccessible, but an outage-tracking service no longer showed any major general disruption.

What the hackers show, and what they don't

According to the group, the stolen data includes names, postal addresses, mobile numbers, email addresses and account information, and possibly bank details. It also mentions access to passwords and financial documents, without demonstrating anything. Its evidence is limited to screenshots of customer portals. One of them shows a "Bank details" section with a direct debit notice and a partially masked IBAN. The site Fuites Infos notes that it shows the home page of a customer portal and the amount of the latest bill, but no phone number or postal address.

No file has been published. As FrenchBreaches points out, these images don't say where the data came from: an intrusion into the carrier's systems, or a few customer accounts hacked one by one. Nor do they prove that 25,000 records were extracted. That figure would represent about 1% of the 2.4 million subscribers the carrier had when it was acquired, according to Frandroid.

A DDoS attack does not steal data

A distributed denial-of-service (DDoS) attack floods a website with requests to make it inaccessible. It gives no access to databases. The two claims made on October 21 must therefore be assessed separately, and no technical link between them has been established.

NoName057(16), which emerged in 2022, is best known for this type of attack. In late December 2025, it claimed a DDoS attack that disrupted the online services of La Poste and La Banque Postale. La Poste then stated that no customer data had been compromised. In July 2025, a European and US police operation had nevertheless taken down about a hundred of its servers.

La Poste Mobile customers: what to do

Whether the leak is real or not, the claim provides a perfect pretext for scammers. A message that mentions your plan or your latest bill will look credible.

• Be wary of emails and text messages claiming to come from La Poste Mobile, especially if they demand a payment or an account "verification."
• Log in only through the official website or app, never through a link you received.
• Never give a code received by text message, a password or your bank details to someone who contacts you.
• Monitor your bank statements and dispute any unfamiliar debit.
• If in doubt, the website cybermalveillance.gouv.fr offers free assistance.

The scenario recalls other recent claims, such as the one targeting Solutions30, a subcontractor of Orange and Enedis, which remained unconfirmed. It remains to be seen whether La Poste Mobile will confirm an intrusion, and whether a file will eventually surface.