John Paul: hacked email account, 4,179 banking concierge clients affected
Concierge service John Paul confirmed a professional email
account was compromised via phishing, affecting 4,179 clients
within the BPCE banking group. Coordination underway with Société Générale and La Banque
Postale.
⚠️ Confirmed, scope limited to one email account per the
current investigation. John Paul states the incident is limited to a single
compromised professional email account, with no other system or account affected according
to investigations communicated at this stage.
The numbers
4,179
Clients within the BPCE banking group (Banques Populaires, Caisses
d'Épargne) affected by the incident.
FrenchBreaches, John Paul statement.
Aug 5
Date the compromise of the professional email account was detected,
following a phishing attack.
John Paul statement.
1
Professional email account compromised, per investigations at this
stage — no other system or account affected.
John Paul statement.
3
Banking groups named in coordination: BPCE (affected perimeter),
Société Générale and La Banque Postale (banks informed).
John Paul statement.
Timeline
CONFIRMED
August 5, 2026
John Paul detects the compromise of a professional email account
following a phishing attack. An external actor gains unauthorized access to certain
data concerning clients benefiting from concierge services.
CONFIRMED
Follow-up
The incident is contained to 4,179 clients within the BPCE
perimeter. John Paul states it coordinated with other banks concerned by this
concierge service, notably Société Générale and La Banque Postale.
✉️A service shared across several banks
This case file reveals a fact rarely visible to the public: several major French
banks use the same concierge vendor for their premium clients. An incident at this
single vendor could, in theory, affect clients of different banks at once — even though
here, the confirmed scope remains limited to BPCE.
What it changes for you
If you're a premium client of a BPCE-group bank using the John Paul concierge service,
data you shared through it could have been exposed via the compromised email account. The
main risk is a message posing as your bank or John Paul, relying on real details from your
concierge requests. See From Leak to Scam.
🔒 A banking concierge service will never ask for your banking
credentials or a validation code by email — verify any unusual request by phone with your
advisor.
Frequently asked questions
Is the John Paul leak confirmed?
Yes, by the company itself: email account compromised via phishing, 4,179 BPCE
clients affected.
What is the John Paul banking concierge service?
A service offered by some banks to premium clients to delegate personal
errands.
Are other banks affected?
The confirmed scope is BPCE; Société Générale and La Banque Postale were informed in
coordination.
📌 Last checked: August 21, 2026. Verifiable
information to report: contact@egidio.app.