EE Linked My Business Account to a Stranger's Account. A Year Later They're Still Sending Me His Emails. SERIOUS DATA BREACH
I genuinely thought it was spam.
In July 2025 I renewed my EE Business mobile contract.
Shortly afterwards I started receiving emails about an EE residential broadband account.
Like most people probably would, I ignored them.
I assumed they were marketing emails or some automated mistake.
Over the following months they kept arriving.
Eventually I logged into my EE account to find out why.
That was the beginning of what has become almost a year-long dispute with EE, an investigation by the Communications Ombudsman, an admitted systems error, an admitted data breach, and now legal proceedings.
And somehow...
I'm still receiving emails about somebody else's broadband account.
Two customers. Same name.
When I contacted EE, I expected someone to tell me there had simply been an error.
Instead, I was told something entirely different.
The adviser informed me that it appeared someone had fraudulently opened an account using my details.
EE treated it as suspected fraud.
They even emailed me information taken from the other customer's account, including banking information, and advised me that I could report the matter to the police.
I cancelled the card, which in itself caused a huge amount of hassle for my business.
At that point even EE didn't understand what had actually happened.
Then things became even stranger.
Concerned that somebody else's bank account appeared connected to my EE account, I visited the bank branch i was given information for.
The staff checked the details.
They told me there was nothing to suggest the account itself was fraudulent.
So I visited my local EE store.
After accessing my account, an employee informed me that another customers mobile number appeared on my account.
I was then given his telephone number IN STORE because, as the adviser explained, it appeared to belong to my account.
Think about that for a moment.
An EE employee believed another customer's mobile number was effectively mine because of how EE's systems were displaying the accounts.
I rang the other customer.
It was one of the strangest phone calls I've ever made.
He confirmed he had been able to see information relating to my account.
He had seen my invoices.
He had seen information relating to my billing.
From his perspective nothing appeared wrong because all of his services continued working normally.
He simply hadn't realised anything was wrong.
Two completely unrelated customers.
One account.
Then EE went silent.
I immediately reported everything.
Within hours I lost access to my online account.
No explanation.
No meaningful updates.
No resolution.
For approximately five months I repeatedly chased EE while remaining unable to properly access my account.
Eventually EE accidentally copied me into one of their own internal email chains discussing my complaint.
Ironically, another internal mistake gave me confirmation that the matter was being discussed while I continued receiving virtually no meaningful updates.
Five months later...
EE finally admitted what had actually happened.
Two completely unrelated customers sharing the same name had been incorrectly linked together because of an internal systems error.
They also confirmed that a data breach had been recorded internally.
At that point I assumed the nightmare was over.
It wasn't.
They told me it was fixed.
It wasn't.
Even after EE confirmed the issue had supposedly been resolved, I continued receiving broadband billing notifications relating to the other customer's account.
Their own complaints specialist repeatedly acknowledged internally that the residential broadband account had still not been properly removed.
Months after telling me everything had been fixed...
...it plainly hadn't.
The Communications Ombudsman agreed.
After reviewing the evidence, the Communications Ombudsman upheld my complaint.
The Ombudsman concluded that EE:
- failed to investigate the issue properly after it was first reported;
- failed to take timely action;
- incorrectly advised that the matter had been resolved;
- allowed administrative errors to continue;
- failed to provide an acceptable standard of customer service.
The Ombudsman ordered EE to:
- pay compensation;
- apologise in writing;
- confirm that the third-party account had finally been removed;
- confirm that no adverse credit information had been recorded.
Importantly, however, the Ombudsman also explained that it has no jurisdiction to determine claims under the UK GDPR or the Data Protection Act 2018.
Those legal issues remain for the courts.
Then EE pursued me for payment.
While all of this was going on, my account was restricted without any or little communication, my account suspected of potential identity theft.
Despite the ongoing dispute, despite the admitted systems error, despite the Ombudsman investigation, EE continued billing me.
When I disputed those charges, the outstanding balance was eventually referred to a third-party debt collection agency.
So, after admitting a systems error.
After recording a data breach.
After the Communications Ombudsman upheld my complaint.
EE's response was to continue pursuing the disputed balance.
That sequence of events speaks for itself.
And then... this happened.
This week I received another email from EE.
Not about my account.
About the other customer's broadband service.
The email confirmed the cancellation of their broadband and contained THEIR HOME ADDRESS.
Read that again.
After:
- months of complaints;
- an admitted systems error;
- an admitted data breach;
- a Communications Ombudsman investigation;
- findings against EE;
- compensation;
- written assurances that the accounts had been separated...
...EE is still sending me communications relating to another customer's account.
I genuinely couldn't believe it when it arrived.
Why I'm writing this.
This isn't about trying to embarrass EE.
It's about accountability.
If this could happen to me, it raises obvious questions that every EE customer should be asking.
- How are customer accounts matched?
- What safeguards exist to stop two unrelated people being merged together?
- How long can these errors continue without detection?
- How many people would even realise it had happened?
- If an admitted systems error can continue even after an Ombudsman investigation, how confident should customers be that similar issues are always resolved?
These are fair questions.
Where things stand now.
I am currently preparing legal proceedings against EE.
The Communications Ombudsman has already upheld my complaint and established a number of important factual findings.
However, the Ombudsman made clear that questions relating to liability under the UK General Data Protection Regulation and the Data Protection Act 2018 fall outside its jurisdiction.
Those issues remain unresolved.
I therefore intend to ask the courts to determine those matters.
Final thoughts
Mistakes happen.
Every company makes mistakes.
What defines an organisation is how it responds when those mistakes are discovered.
In my case, this wasn't a single administrative error.
It became months of incorrect information, conflicting explanations, prolonged delays, continued billing, debt collection activity, an Ombudsman investigation, admitted failings, and, astonishingly, even now, further emails relating to another customer's account.
If you're an EE customer, I'd encourage you to regularly check your account, review unexpected communications carefully, and query anything that doesn't look right.
Because if this experience has taught me anything, it's that sometimes what first looks like a harmless billing email can turn out to be something far more serious.
I've been an EE customer from the very beginning and after this I will never use their services again, I just don't trust them with my information and personally I don't think any of us can.
