EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

[Tage_Mahall]

I’m posting this to warn others and to see if anyone has experienced similar issues.

Timeline:

July 2025: Renewed my EE mobile contract in store.

August–October 2025: Received repeated “Your EE Broadband Bill Is Ready” emails despite not having EE broadband.

10 Oct 2025: Discovered EE had incorrectly linked a broadband account (different address, different bank account) to my name, DOB, email and phone number.

EE confirmed another customer could see my mobile devices, invoices and personal details, and I could see elements of theirs.

Police and Action Fraud were initially involved before confirming this was an EE data-handling error, not fraud.

I submitted a formal GDPR breach complaint to EE in October — no response.

Shortly after, my online account was locked.

January 2026: EE has now restricted my mobile calls and I’ve received yet another broadband bill email for an account that isn’t mine.

At no point has EE acknowledged the breach, explained what happened, or corrected the data. Instead, my service has been restricted while the issue remains unresolved.

If anyone from EE monitors this forum, I would welcome an explanation as to:

Why a confirmed data breach has gone unanswered for months;

Why inaccurate personal data is still being processed;

Why customer services are being restricted instead of resolved.

This has now been reported to the ICO.

[ee_user14]

---

@Tage_Mahall wrote:

Because I won;t let EE hide the outcome of all of this under this old thread, this is something completely new and was not intended as an update

---

The "outcome" of something is not "completely new" - that's a contradiction.

If you've been to the Ombudsman, then by definition EE will have set out their final position and nothing the forum team can say or do will alter that.

If you've served legal papers on EE's registered address, then the forum team shouldn't be getting involved any further anyway. That should be standard practice on any company.

[Tage_Mahall]

I think you're misunderstanding what I am saying.

I am not asking the forum team to alter, overturn or reconsider the Ombudsman's decision.

The Ombudsman process dealt with the complaint as it stood at the time of its investigation. I have accepted that process and am now dealing separately with the legal issues that remain outstanding.

What I have reported here is a new event which occurred after that process.

Yesterday, EE sent me another email relating to the other customer's residential broadband account, including personal information relating to that customer. This occurred despite EE previously confirming to both myself and the Ombudsman that the account had been removed and the issue resolved.

That is not "the outcome" of the previous complaint. It is a new incident which appears to demonstrate that the underlying account-linking problem has continued after EE represented that it had been fixed.

It is therefore entirely reasonable for me to report it and to ask why it has happened.

I have already notified EE's Executive Complaints Team and the senior personnel to whom I previously sent my Letter of Claim. This latest incident will also be incorporated into my ongoing legal correspondence.

As for your point that the forum team should not become involved once legal proceedings have commenced, I agree — which is precisely why I am not asking the forum team to resolve the legal dispute.

I am simply documenting what has happened and asking why EE has once again sent me another customer's information after previously confirming that this issue had been resolved.

If EE's position is that this latest email was sent to me in error, then I would suggest that is precisely the sort of matter EE itself should be investigating rather than dismissing as merely "the outcome" of an old complaint.

[garybs29]

If yoy've started legal proceedings why are you publically posting about them?

[Tage_Mahall]

Because I have not said anything publicly that compromises the legal proceedings or discloses confidential information.

The purpose of my posts is to document what has happened and raise awareness of the data-security issues involved. The events I'm discussing are my own experience, and I'm entitled to discuss them publicly.

I've also been very careful not to publish confidential information belonging to the other customer, despite the fact that EE itself has repeatedly disclosed information relating to him to me.

The legal proceedings are based on the evidence and correspondence between myself and EE. Posting about my experience on a public forum doesn't prevent EE from responding to the claim or defending itself in court.

If anything, given the circumstances, I think it's entirely reasonable to ask why a company that has already admitted an account-linking error and a recorded data breach continues to have issues involving the same two customers almost a year later.