Skip to content
Breach Index · running record

BNP Paribas data breach history (2016-2026): Cetelem 2026, NotPetya 2017 and a Geneva insider case

BNP Paribas’s confirmed incidents in the last ten years sit in its subsidiaries: the consumer-credit arm BNP Paribas Personal Finance (Cetelem) in 2026, the real-estate arm in the 2017 NotPetya-style outbreak, and its Swiss unit, where an IT contractor was convicted of taking client data. This page lists each with its sources and says where the facts are thin.

Short answer

Was BNP Paribas hacked?

Yes. BNP Paribas Personal Finance, which runs Cetelem, confirmed on 6 May 2026 that an intrusion on 20 April 2026 had exposed several hundred thousand customer accounts, per INCYBER News. BNP Paribas said only email addresses were taken, not bank details, payment data or passwords. Customers were told to be very careful about phishing, and France’s data protection authority, the CNIL, was notified.

Earlier, in June 2017, a BNP Paribas spokeswoman told Reuters that the global NotPetya-style attack had hit its real-estate subsidiary and that “the necessary measures have been taken to rapidly contain the attack.” In 2022 a Geneva court convicted an IT contractor of taking confidential client data from BNP Paribas in Geneva, per the Tribune de Genève.

Timeline at a glance

  1. 6 May 2026BNP Paribas Personal Finance (Cetelem) confirms 20 April intrusion; email addresses of several hundred thousand accounts taken. (INCYBER News)Confirmed
  2. 9 Nov 2025Forum seller offers ~27,000 records it ties to BNP Paribas; no BNP confirmation. (Botcrawl)Unverified claim
  3. Nov 2025 – Jan 2026Not named in coverage of the SitusAMC or Fried Frank vendor breaches. (Bank Info Security)Not a breach
  4. 29 Jul 2022IT contractor convicted in Geneva for taking BNP Paribas client data. (Tribune de Genève)Reported
  5. 28 Jun 2017NotPetya-style attack blocks staff computers at BNP Paribas Real Estate. (Reuters / Fortune)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

BNP Paribas incident timeline, in detail

Confirmed = acknowledged by BNP Paribas, a regulator filing or a court. Reported = credible reporting BNP Paribas has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Apr – May 2026ConfirmedIntrusion / consumer credit subsidiary

Cetelem: customer email addresses stolen from BNP Paribas Personal Finance

What happened. INCYBER News reported that BNP Paribas Personal Finance, which operates Cetelem, Cofinoga and Findomestic, confirmed on 6 May 2026 an intrusion that took place on 20 April 2026. Customers were informed in early May and told to be very careful about phishing. BNP Paribas notified the CNIL.

Impact. Several hundred thousand accounts, out of a customer base of several million. BNP Paribas said only email addresses were stolen; bank details, payment information and passwords were not affected. The article does not say which brands’ customers were hit.

Sources: INCYBER News, 7 May 2026

Nov 2025Unverified claimDark-web sale claim

Forum listing offers about 27,000 records tied to BNP Paribas

What happened. Botcrawl, a breach-news site, reported an unnamed seller on a cybercrime forum offering over 27,000 database records it tied to BNP Paribas, described as “fresher than 2025/09”, with access sold weekly or for life via Telegram.

Impact. No BNP Paribas entity is named and BNP Paribas has not confirmed it. Botcrawl itself says the details are unverified. We found no mainstream outlet reporting it.

Sources: Botcrawl, 9 Nov 2025

Reported Jul 2022ReportedInsider / contractor

IT contractor convicted for taking client data at BNP Paribas in Geneva

What happened. The Tribune de Genève, republished by COMBourse, reported that an external IT specialist was convicted for transferring confidential information on BNP Paribas clients in Geneva without authorisation. He denied intending to resell it.

Impact. Confidential client data of the Swiss unit. The volume, the dates of the theft and the sentence were not given in the version we read.

Sources: Tribune de Genève via COMBourse, 29 Jul 2022

Jun 2017ConfirmedDestructive malware

NotPetya-style attack hits BNP Paribas Real Estate

What happened. A BNP Paribas spokeswoman told Reuters that the worldwide attack that started in Russia and Ukraine had hit the real-estate subsidiary, and that “the necessary measures have been taken to rapidly contain the attack.” A person familiar with the matter said some staff computers were blocked.

Impact. Disruption to staff computers at the subsidiary. No data theft was reported.

Sources: Reuters via Fortune, 28 Jun 2017

Where the reports disagree

  • How many Cetelem accounts in 2026? Reports say “several hundred thousand”; BNP Paribas did not give an exact figure in the coverage we read.

The pattern across the record

Incidents land in subsidiaries, not the core bank

Consumer credit, real estate and the Swiss private bank each had their own incident. A group this size has many separate customer databases, and each needs its own controls.

Email-only leaks still fuel phishing

The 2026 theft was limited to email addresses, but a list of confirmed customers of a lender is exactly what a phishing campaign needs. That is why BNP Paribas’s warning was about phishing.

What it means for BNP Paribas customers — and what to do

For Cetelem and other BNP Paribas customers, the main risk from the 2026 incident is phishing that uses the knowledge that you are a customer.

  1. 1.Expect phishing that names Cetelem or BNP Paribas

    Do not click links in emails about your credit or account. Sign in through the app or a site address you type yourself.

    Phishing-resistant MFA planner
  2. 2.Do not give codes or card details on the phone

    Hang up and call back on the number in your contract or app if someone calls about fraud on your account.

    Voice-clone fraud checklist
  3. 3.Read any notice you receive

    Check which data it lists. If only your email was taken, change nothing else, but stay alert to scams.

    Breach notice decoder

CISO takeaways

Rehearse a customer database breach

Practise scoping, notifying the regulator within 72 hours and warning customers about follow-on phishing.

Customer Database Breach Lab
Plan for insider and contractor theft

The Geneva case was an outside IT specialist with legitimate access.

Insider Data Theft Lab
Know your notification clocks

GDPR’s 72 hours and customer notices run on different timelines.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Cetelem victime d’une fuite de données : des centaines de milliers d’adresses e-mail dérobées — INCYBER News, 7 May 2026
  2. 2.BNP Paribas data breach exposes 27,000 financial records on hacker forum — Botcrawl, 9 Nov 2025
  3. 3.Un informaticien a volé des données chez BNP Paribas à Genève — Tribune de Genève (via COMBourse), 29 Jul 2022
  4. 4.Petya ransomware cyber attack hits BNP Paribas unit — Reuters / Fortune, 28 Jun 2017
  5. 5.Major US banks gauge their exposure to SitusAMC breach — Bank Info Security, 24 Nov 2025
  6. 6.After Goldman, JPMorgan discloses law firm data breach — SecurityWeek, 13 Jan 2026
  7. 7.Chain IQ, UBS data stolen in ransomware attack — SecurityWeek, 19 Jun 2025

Frequently asked questions

Was BNP Paribas hacked?

Yes. Its consumer-credit arm, BNP Paribas Personal Finance (Cetelem), confirmed in May 2026 that an intrusion in April 2026 exposed the email addresses of several hundred thousand accounts. Its real-estate arm was hit by the 2017 NotPetya-style attack.

What happened in the Cetelem data breach?

An intrusion on 20 April 2026 took customer email addresses, per BNP Paribas. It said bank details, payment information and passwords were not affected, warned customers about phishing and notified the CNIL.

Is there a BNP Paribas data breach in 2025?

Only a claim. A forum seller offered about 27,000 records it tied to BNP Paribas in November 2025, reported by Botcrawl. BNP Paribas has not confirmed it.

Was BNP Paribas affected by the Chain IQ or SitusAMC breaches?

BNP Paribas was not named in the coverage we read of either. SecurityWeek’s Chain IQ coverage named UBS, and Pictet, Manor and Implenia per local media; SitusAMC coverage named JPMorgan Chase, Citi and Morgan Stanley.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by BNP Paribas. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.