Lyca Mobile France Suffers Alleged Data Breach, Again… 1.5M Users Impacted
Telecom giant Lyca Mobile France has allegedly suffered a significant data breach once again, exposing the personal data of over 1.5 million users. The breach, which reportedly occurred in February 2025, was disclosed on a well-known cybercrime forum
Details of the Alleged Breach
The forum post claims that the data was extracted using retailer access, following Lyca Mobile’s decision to disable the DevTool on their retailer panel and limit concurrent database connections. The hacker claims to have used a script to generate a range of Lyca Mobile phone numbers and scrape user data over nine days before their VPS rebooted unexpectedly.
The leaked dataset reportedly includes:
- Mobile numbers
- PUK codes
- ICCID (SIM card identifiers)
- IMSI numbers
- Email addresses
- First and last names
- Registration dates
A sample dataset has been shared via Pastebin, purportedly confirming the leak. The exposed data, including ICCID and IMSI numbers, is particularly concerning as it could facilitate SIM swapping attacks, identity fraud, and unauthorized access to personal accounts.
Potential Impact on Lyca Mobile Users
With 1.5 million users affected, including 437,000 unique email addresses, this breach poses serious risks. Cybercriminals could exploit the leaked data to:
- Perform phishing attacks targeting affected users.
- Conduct SIM swap fraud, enabling unauthorized access to financial and social media accounts.
- Leak or sell personally identifiable information (PII) on dark web marketplaces.
Lyca Mobile’s Response
As of now, Lyca Mobile has not officially commented on the alleged breach. Users are strongly advised to take the following precautions:
- Enable two-factor authentication (2FA) on all sensitive accounts.
- Be wary of phishing emails or suspicious communications.
- Change passwords associated with their Lyca Mobile account.
- Contact Lyca Mobile to verify if their information has been compromised.
This is not the first time Lyca Mobile has been targeted by cybercriminals. Previous breaches have raised concerns about the company's security infrastructure, with incidents involving unauthorized access to customer data surfacing in past years. The recurrence of such breaches underscores the urgent need for enhanced security measures to protect user information.