EE Data Breach Ongoing for 6+ Months – Account Locked, Calls Restricted, Still B

[Tage_Mahall]

I’m posting this to warn others and to see if anyone has experienced similar issues.

Timeline:

July 2025: Renewed my EE mobile contract in store.

August–October 2025: Received repeated “Your EE Broadband Bill Is Ready” emails despite not having EE broadband.

10 Oct 2025: Discovered EE had incorrectly linked a broadband account (different address, different bank account) to my name, DOB, email and phone number.

EE confirmed another customer could see my mobile devices, invoices and personal details, and I could see elements of theirs.

Police and Action Fraud were initially involved before confirming this was an EE data-handling error, not fraud.

I submitted a formal GDPR breach complaint to EE in October — no response.

Shortly after, my online account was locked.

January 2026: EE has now restricted my mobile calls and I’ve received yet another broadband bill email for an account that isn’t mine.

At no point has EE acknowledged the breach, explained what happened, or corrected the data. Instead, my service has been restricted while the issue remains unresolved.

If anyone from EE monitors this forum, I would welcome an explanation as to:

Why a confirmed data breach has gone unanswered for months;

Why inaccurate personal data is still being processed;

Why customer services are being restricted instead of resolved.

This has now been reported to the ICO.

[Leanne_T]

Hi @Tage_Mahall 

I've sent you a private message to try and get you some help with this. Could you take a look at your private message inbox and get back to me please?

Thank you.

Leanne. 

[Tage_Mahall]

Update - details were sent over to the complaints team to email but as of today still not received anything and still without the ability to access my account or use my phone.

[Tage_Mahall]

EE has now made contact following this post. I am currently engaging directly with Complaints to resolve the issue. I will update once the matter is formally concluded.

[Tage_Mahall]

Day 3 Update - I was contacted yesterday by complaints with an email to give details on my account details so they can have a look,

Today I was emailed to check those details,

It seems you get one email a day, 

Tomorrow I will let you know what email i get then,

[Tage_Mahall]

Update – Day 7

EE have now responded, however the situation has escalated rather than been resolved.

Timeline for clarity:

• Day 1: I reported a serious data protection issue after my business account was merged with another customer’s account.

• Days 3–7: EE claimed they could not progress due to “missing information”, despite multiple emails being opened and not replied to.

• Today: I was informed my account is “suspended for non-payment”, and that the issue is now being passed to the Business Complaints Team.

Key issue still unresolved:
This is not a billing dispute.

Another EE customer was able to:

• Access my bank details

• View invoices

• See account information

• And I was provided their personal details by EE staff

I personally contacted the other customer, who confirmed he had access to my financial information.

Since the account merge:

• I cannot access my own account

• I cannot verify or manage billing

• I have had to take steps to protect my business finances

No explanation has been provided as to:

• How the accounts were merged

• How long access was shared

• Who accessed what data

• Why internal handling has taken days with no meaningful response

I am now awaiting:

• A formal data breach explanation

• Confirmation of scope and duration of exposure

• Assurance this has been contained

• Written confirmation of corrective action

I will continue to update this thread as this progresses.

[Tage_Mahall]

For clarity, this issue is not resolved. regardless of this post being marked as "solved" when I logged in.

No explanation has been provided for:
– Cross-customer account access
– Disclosure of bank details and invoices
– Loss of access to my own account following an account merge

Marking this as “Problem Solved” does not reflect the facts or the current status of the complaint.

[Tage_Mahall]

Update - Day 8

No response to email yesterday and I can see they are actively opening my previous emails sent in October, November and December that were never responded to.

[Tage_Mahall]

Update - Day 9 

No response to my email two days ago, still opening my previous emails sent several months ago that were never responded to,

Still cannot access my own account and still receiving a bill for someone else's broadband despite EE being notified 4 months ago this was not me and they even agreed via email and phone conversation.

Will no one at EE ever get back to me?

[Tage_Mahall]

Update – Day 12

Still no direct contact or resolution from EE.

This is a business mobile account and I remain completely unable to access it. I cannot log in via the EE app or the website, and I cannot use live chat. My phone line has been restricted, meaning I am unable to conduct business by phone.

EE has been aware of this issue since October.

Over the past 12 days:

• Multiple emails have been sent and opened, but largely not responded to

• When responses do arrive, they restart with basic security questions despite EE already confirming internally who I am

• Progress then stops entirely for days at a time

The core issue remains unresolved:

Another EE customer was able to access my account information, including bank details and invoices, for several months. I was initially told this appeared to be fraud, before it became clear this was caused by an EE account merge/data handling failure. I have written evidence of this.

Because of this exposure, I had to:

• Create new business bank accounts

• Isolate finances to protect against misuse

• Deal with disruption and risk to my business operations

Despite this, EE is now denying there is an issue while simultaneously preventing me from accessing my own account to resolve it.

To be clear:

• I am not refusing to engage

• I physically cannot access my account

• I cannot call in, and I cannot use chat

• Email is the only channel available, and responses are sporadic at best

What makes this particularly concerning is that EE staff internally acknowledge the situation, yet externally nothing is being resolved. I also now have evidence of internal emails being misdirected, further highlighting ongoing data handling problems.

This situation has been ongoing for months. The lack of urgency, accountability, and meaningful action is having a real-world impact on my business.

I would strongly encourage any EE customer, especially business customers, to regularly review their account details and billing information. In my case, this went unnoticed for months and was not flagged by EE.

I am still waiting for:

• Full restoration of access to my account

• A clear explanation of how this occurred

• Confirmation of what personal and financial data was exposed

• Assurance that this cannot happen again