topic Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B in EE app and website

EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Wed, 07 Jan 2026 17:44:50 GMT

I’m posting this to warn others and to see if anyone has experienced similar issues.

Timeline:

July 2025: Renewed my EE mobile contract in store.

August–October 2025: Received repeated “Your EE Broadband Bill Is Ready” emails despite not having EE broadband.

10 Oct 2025: Discovered EE had incorrectly linked a broadband account (different address, different bank account) to my name, DOB, email and phone number.

EE confirmed another customer could see my mobile devices, invoices and personal details, and I could see elements of theirs.

Police and Action Fraud were initially involved before confirming this was an EE data-handling error, not fraud.

I submitted a formal GDPR breach complaint to EE in October — no response.

Shortly after, my online account was locked.

January 2026: EE has now restricted my mobile calls and I’ve received yet another broadband bill email for an account that isn’t mine.

At no point has EE acknowledged the breach, explained what happened, or corrected the data. Instead, my service has been restricted while the issue remains unresolved.

If anyone from EE monitors this forum, I would welcome an explanation as to:

Why a confirmed data breach has gone unanswered for months;

Why inaccurate personal data is still being processed;

Why customer services are being restricted instead of resolved.

This has now been reported to the ICO.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Leanne_T — Wed, 07 Jan 2026 18:14:24 GMT

Hi @Tage_Mahall

I've sent you a private message to try and get you some help with this. Could you take a look at your private message inbox and get back to me please?

Thank you.

Leanne.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 08 Jan 2026 14:26:38 GMT

Update - details were sent over to the complaints team to email but as of today still not received anything and still without the ability to access my account or use my phone.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 08 Jan 2026 15:48:24 GMT

EE has now made contact following this post. I am currently engaging directly with Complaints to resolve the issue. I will update once the matter is formally concluded.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Fri, 09 Jan 2026 15:31:33 GMT

Day 3 Update - I was contacted yesterday by complaints with an email to give details on my account details so they can have a look,

Today I was emailed to check those details,

It seems you get one email a day,

Tomorrow I will let you know what email i get then,

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Wed, 14 Jan 2026 16:12:15 GMT

Update – Day 7

EE have now responded, however the situation has escalated rather than been resolved.

Timeline for clarity:

Day 1: I reported a serious data protection issue after my business account was merged with another customer’s account.
Days 3–7: EE claimed they could not progress due to “missing information”, despite multiple emails being opened and not replied to.
Today: I was informed my account is “suspended for non-payment”, and that the issue is now being passed to the Business Complaints Team.

Key issue still unresolved:
This is not a billing dispute.

Another EE customer was able to:

Access my bank details
View invoices
See account information
And I was provided their personal details by EE staff

I personally contacted the other customer, who confirmed he had access to my financial information.

Since the account merge:

I cannot access my own account
I cannot verify or manage billing
I have had to take steps to protect my business finances

No explanation has been provided as to:

How the accounts were merged
How long access was shared
Who accessed what data
Why internal handling has taken days with no meaningful response

I am now awaiting:

A formal data breach explanation
Confirmation of scope and duration of exposure
Assurance this has been contained
Written confirmation of corrective action

I will continue to update this thread as this progresses.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Wed, 14 Jan 2026 16:15:42 GMT

For clarity, this issue is not resolved. regardless of this post being marked as "solved" when I logged in.

No explanation has been provided for:
– Cross-customer account access
– Disclosure of bank details and invoices
– Loss of access to my own account following an account merge

Marking this as “Problem Solved” does not reflect the facts or the current status of the complaint.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 15 Jan 2026 16:36:14 GMT

Update - Day 8

No response to email yesterday and I can see they are actively opening my previous emails sent in October, November and December that were never responded to.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Fri, 16 Jan 2026 13:31:44 GMT

Update - Day 9

No response to my email two days ago, still opening my previous emails sent several months ago that were never responded to,

Still cannot access my own account and still receiving a bill for someone else's broadband despite EE being notified 4 months ago this was not me and they even agreed via email and phone conversation.

Will no one at EE ever get back to me?

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Mon, 19 Jan 2026 13:40:42 GMT

Update – Day 12

Still no direct contact or resolution from EE.

This is a business mobile account and I remain completely unable to access it. I cannot log in via the EE app or the website, and I cannot use live chat. My phone line has been restricted, meaning I am unable to conduct business by phone.

EE has been aware of this issue since October.

Over the past 12 days:

Multiple emails have been sent and opened, but largely not responded to
When responses do arrive, they restart with basic security questions despite EE already confirming internally who I am
Progress then stops entirely for days at a time

The core issue remains unresolved:

Another EE customer was able to access my account information, including bank details and invoices, for several months. I was initially told this appeared to be fraud, before it became clear this was caused by an EE account merge/data handling failure. I have written evidence of this.

Because of this exposure, I had to:

Create new business bank accounts
Isolate finances to protect against misuse
Deal with disruption and risk to my business operations

Despite this, EE is now denying there is an issue while simultaneously preventing me from accessing my own account to resolve it.

To be clear:

I am not refusing to engage
I physically cannot access my account
I cannot call in, and I cannot use chat
Email is the only channel available, and responses are sporadic at best

What makes this particularly concerning is that EE staff internally acknowledge the situation, yet externally nothing is being resolved. I also now have evidence of internal emails being misdirected, further highlighting ongoing data handling problems.

This situation has been ongoing for months. The lack of urgency, accountability, and meaningful action is having a real-world impact on my business.

I would strongly encourage any EE customer, especially business customers, to regularly review their account details and billing information. In my case, this went unnoticed for months and was not flagged by EE.

I am still waiting for:

Full restoration of access to my account
A clear explanation of how this occurred
Confirmation of what personal and financial data was exposed
Assurance that this cannot happen again

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Katie_J — Mon, 19 Jan 2026 13:59:06 GMT

Hello @Tage_Mahall.

I am so sorry to hear there is no update on your complaint.

I have sent you over a private message to gather more details.

Katie

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Mon, 19 Jan 2026 16:27:53 GMT

Thank you, I have replied to your message.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Tue, 20 Jan 2026 20:42:03 GMT

Update Day 13 - Still nothing from EE

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Wed, 21 Jan 2026 13:28:14 GMT

Update Day 14 - No reply or any email from EE

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 22 Jan 2026 15:52:16 GMT

Update Day 15 - After being told someone would reach out to me, I haven't received anything from EE

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 06 Aug 2026 13:50:50 GMT

EE Linked My Business Account to a Stranger's Account. A Year Later They're Still Sending Me His Emails. SERIOUS DATA BREACH

I genuinely thought it was spam.

In July 2025 I renewed my EE Business mobile contract.

Shortly afterwards I started receiving emails about an EE residential broadband account.

Like most people probably would, I ignored them.

I assumed they were marketing emails or some automated mistake.

Over the following months they kept arriving.

Eventually I logged into my EE account to find out why.

That was the beginning of what has become almost a year-long dispute with EE, an investigation by the Communications Ombudsman, an admitted systems error, an admitted data breach, and now legal proceedings.

And somehow...

I'm still receiving emails about somebody else's broadband account.

Two customers. Same name.

When I contacted EE, I expected someone to tell me there had simply been an error.

Instead, I was told something entirely different.

The adviser informed me that it appeared someone had fraudulently opened an account using my details.

EE treated it as suspected fraud.

They even emailed me information taken from the other customer's account, including banking information, and advised me that I could report the matter to the police.

I cancelled the card, which in itself caused a huge amount of hassle for my business.

At that point even EE didn't understand what had actually happened.

Then things became even stranger.

Concerned that somebody else's bank account appeared connected to my EE account, I visited the bank branch i was given information for.

The staff checked the details.

They told me there was nothing to suggest the account itself was fraudulent.

So I visited my local EE store.

After accessing my account, an employee informed me that another customers mobile number appeared on my account.

I was then given his telephone number IN STORE because, as the adviser explained, it appeared to belong to my account.

Think about that for a moment.

An EE employee believed another customer's mobile number was effectively mine because of how EE's systems were displaying the accounts.

I rang the other customer.

It was one of the strangest phone calls I've ever made.

He confirmed he had been able to see information relating to my account.

He had seen my invoices.

He had seen information relating to my billing.

From his perspective nothing appeared wrong because all of his services continued working normally.

He simply hadn't realised anything was wrong.

Two completely unrelated customers.

One account.

Then EE went silent.

I immediately reported everything.

Within hours I lost access to my online account.

No explanation.

No meaningful updates.

No resolution.

For approximately five months I repeatedly chased EE while remaining unable to properly access my account.

Eventually EE accidentally copied me into one of their own internal email chains discussing my complaint.

Ironically, another internal mistake gave me confirmation that the matter was being discussed while I continued receiving virtually no meaningful updates.

Five months later...

EE finally admitted what had actually happened.

Two completely unrelated customers sharing the same name had been incorrectly linked together because of an internal systems error.

They also confirmed that a data breach had been recorded internally.

At that point I assumed the nightmare was over.

It wasn't.

They told me it was fixed.

It wasn't.

Even after EE confirmed the issue had supposedly been resolved, I continued receiving broadband billing notifications relating to the other customer's account.

Their own complaints specialist repeatedly acknowledged internally that the residential broadband account had still not been properly removed.

Months after telling me everything had been fixed...

...it plainly hadn't.

The Communications Ombudsman agreed.

After reviewing the evidence, the Communications Ombudsman upheld my complaint.

The Ombudsman concluded that EE:

failed to investigate the issue properly after it was first reported;
failed to take timely action;
incorrectly advised that the matter had been resolved;
allowed administrative errors to continue;
failed to provide an acceptable standard of customer service.

The Ombudsman ordered EE to:

pay compensation;
apologise in writing;
confirm that the third-party account had finally been removed;
confirm that no adverse credit information had been recorded.

Importantly, however, the Ombudsman also explained that it has no jurisdiction to determine claims under the UK GDPR or the Data Protection Act 2018.

Those legal issues remain for the courts.

Then EE pursued me for payment.

While all of this was going on, my account was restricted without any or little communication, my account suspected of potential identity theft.

Despite the ongoing dispute, despite the admitted systems error, despite the Ombudsman investigation, EE continued billing me.

When I disputed those charges, the outstanding balance was eventually referred to a third-party debt collection agency.

So, after admitting a systems error.

After recording a data breach.

After the Communications Ombudsman upheld my complaint.

EE's response was to continue pursuing the disputed balance.

That sequence of events speaks for itself.

And then... this happened.

This week I received another email from EE.

Not about my account.

About the other customer's broadband service.

The email confirmed the cancellation of their broadband and contained THEIR HOME ADDRESS.

Read that again.

After:

months of complaints;
an admitted systems error;
an admitted data breach;
a Communications Ombudsman investigation;
findings against EE;
compensation;
written assurances that the accounts had been separated...

...EE is still sending me communications relating to another customer's account.

I genuinely couldn't believe it when it arrived.

Why I'm writing this.

This isn't about trying to embarrass EE.

It's about accountability.

If this could happen to me, it raises obvious questions that every EE customer should be asking.

How are customer accounts matched?
What safeguards exist to stop two unrelated people being merged together?
How long can these errors continue without detection?
How many people would even realise it had happened?
If an admitted systems error can continue even after an Ombudsman investigation, how confident should customers be that similar issues are always resolved?

These are fair questions.

Where things stand now.

I am currently preparing legal proceedings against EE.

The Communications Ombudsman has already upheld my complaint and established a number of important factual findings.

However, the Ombudsman made clear that questions relating to liability under the UK General Data Protection Regulation and the Data Protection Act 2018 fall outside its jurisdiction.

Those issues remain unresolved.

I therefore intend to ask the courts to determine those matters.

Final thoughts

Mistakes happen.

Every company makes mistakes.

What defines an organisation is how it responds when those mistakes are discovered.

In my case, this wasn't a single administrative error.

It became months of incorrect information, conflicting explanations, prolonged delays, continued billing, debt collection activity, an Ombudsman investigation, admitted failings, and, astonishingly, even now, further emails relating to another customer's account.

If you're an EE customer, I'd encourage you to regularly check your account, review unexpected communications carefully, and query anything that doesn't look right.

Because if this experience has taught me anything, it's that sometimes what first looks like a harmless billing email can turn out to be something far more serious.

I've been an EE customer from the very beginning and after this I will never use their services again, I just don't trust them with my information and personally I don't think any of us can.

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

garybs29 — Thu, 06 Aug 2026 13:59:13 GMT

Why have you started a new thread on this?

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Ali_A — Thu, 06 Aug 2026 15:25:36 GMT

Hi @Tage_Mahall

Thank you for the update. We're sorry to hear you still have an ongoing issue with this.

I'm concerned to hear how long this has continued for. I'd like to get you some further help with this.
I'll send you private message. Please check your inbox and get back to me when you can.

Thanks

Ali

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 06 Aug 2026 16:56:57 GMT

Because I won;t let EE hide the outcome of all of this under this old thread, this is something completely new and was not intended as an update

Re: EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

Tage_Mahall — Thu, 06 Aug 2026 17:00:27 GMT

There is no point, your team, EE + BT no longer email or reply, you have been sent letters and clearly the outcome of the ombudsman finding severe data breach issues clearly means nothing to EE, your team as well as your legal team have been sent a letter before claim and none have replied, the depth of this problem is so deep you don't even realise. No one will help and given this was over an hour ago I've heard nothing from anyone so no doubt you have been told not to send me anything. The level at which EE and BT hates is customers is beyond anything I've witnessed and clearly the communication ombudsman agrees as well.