Société Générale data breach history (2016-2026): the 2025 SIM-swap insider case and what else is on record
Société Générale is one of France’s largest banks, with retail (SG, BoursoBank), corporate and investment banking arms. This page lists the cybersecurity incidents we could source from November 2016 to November 2026, newest first, including French-language reporting.
Short answer
Was Société Générale hacked?
We found no confirmed breach of Société Générale’s own systems from 2016 to 2026 in the sources we read. The one confirmed-by-police case is an insider fraud: in June-July 2025 French police arrested a work-study student at the bank’s Paris headquarters accused of passing data on 50 clients to a SIM-swapping network, which used it to take over phone numbers, intercept the bank’s one-time codes and take more than €1 million, as reported by Le Parisien and relayed by Bitdefender and Mac4Ever. The bank stressed that victims were reimbursed.
In January 2022 the French security blog Zataz reported a seller on the dark web offering access to Société Générale internal data; Société Générale asked its CERT to investigate. No breach was confirmed. We found no CNIL sanction against Société Générale, and the bank was not named in the SitusAMC, Fried Frank, Infosys McCamish or Chain IQ vendor incidents.
Timeline at a glance
16 Jul 2025Losses in the SIM-swap case put at over €1M; employee placed under formal investigation. (Mac4Ever)Reported
1 Jul 2025Intern at Paris HQ arrested for allegedly feeding 50 clients’ data to SIM swappers. (Bitdefender (citing Le Parisien))Reported
3 Jan 2022Seller claims access to SG internal data on the dark web; SG’s CERT investigates. (Phonandroid (citing Zataz))Unverified claim
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Société Générale incident timeline, in detail
Confirmed = acknowledged by Société Générale, a regulator filing or a court. Reported = credible reporting Société Générale has not fully confirmed. Unverified claim = an attacker or leak-site claim.
2025ReportedInsider / SIM swap
Intern allegedly passed 50 clients’ data to a SIM-swapping network
What happened. Bitdefender, citing Le Parisien, reported on 1 July 2025 that French police arrested a business-school master’s student interning at Société Générale’s Paris headquarters on Boulevard Haussmann. He allegedly gave clients’ banking information to accomplices, including a SIM-swap specialist, who posed as customers who had lost their phones, had operators move the numbers to SIMs they controlled, and used the bank’s one-time passwords to access accounts. Mac4Ever reported on 16 July 2025 that he was placed under formal investigation (“mis en examen”) for theft and complicity in organised fraud.
Impact. Fifty clients. Losses were first estimated at €65,000 and later put at more than €1 million, per Mac4Ever. Data taken reportedly included names, addresses, bank details and online-banking login identifiers. The bank stressed that victims were reimbursed (paraphrased by Bitdefender; we found no direct statement).
Dark-web seller claims access to Société Générale internal data
What happened. Phonandroid reported on 3 January 2022 that Zataz’s Damien Bancal found a seller offering access to two banks, one of them Société Générale, claiming a flaw gave access to internal data including administrator and employee data. The seller did not say which systems were reachable. Phonandroid said the access had not yet been sold and that Société Générale asked its CERT to investigate.
Impact. No breach, data leak or customer impact was confirmed by Société Générale in the sources we read.
How much was stolen in the SIM-swap case? Early figures were €65,000; later reporting says more than €1 million. Both trace to Le Parisien via secondary outlets, which we could not open.
Bitdefender noted police had separately raided Société Générale offices in Paris and Luxembourg in a tax-fraud and money-laundering probe the week before, and that it was unclear whether the cases were linked. We treat them as unrelated.
The pattern across the record
SMS one-time codes are the weak link
The 2025 fraud did not break the bank’s systems; it combined an insider’s customer data with SIM swaps to receive the bank’s SMS codes. Phone-number-based authentication turns a mobile operator’s help desk into part of the bank’s perimeter.
Claims without confirmation
The 2022 dark-web access sale is typical of access-broker listings: named, investigated, never confirmed. We list it as a claim only.
What it means for Société Générale clients — and what to do
For Société Générale and BoursoBank customers, the lesson of 2025 is about phone-based codes. If someone can move your number, they can receive your bank’s SMS.
1.Use the app’s secure validation instead of SMS where you can
App-based approval tied to your device is harder to hijack than an SMS code sent to a phone number.
We found no confirmed breach of Société Générale’s own systems from 2016 to 2026. In 2025 an intern was accused of passing 50 clients’ data to SIM-swap fraudsters, and in 2022 a dark-web seller claimed access that was never confirmed.
What was the Société Générale SIM-swap fraud?+
French police arrested a work-study student at the Paris headquarters in mid-2025, accused of giving 50 clients’ data to a gang that hijacked their phone numbers and used the bank’s SMS codes to take more than €1 million, per Le Parisien as relayed by Bitdefender and Mac4Ever.
Were Société Générale customers reimbursed?+
Bitdefender reported that the bank stressed victims had been reimbursed. We did not find a direct statement from Société Générale.
Has the CNIL fined Société Générale for a data breach?+
We found no CNIL sanction against Société Générale, BoursoBank or Crédit du Nord for data security in our searches.
Was Société Générale affected by the Chain IQ or SitusAMC breaches?+
We found no reporting naming Société Générale among the firms affected by Chain IQ (2025), SitusAMC (2025), Fried Frank (2025) or Infosys McCamish (2023).
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Société Générale. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.