France fines telcos €42M for sub-par security prior to 24M customer breach
- Reference: 1768403821
- News link: https://www.theregister.co.uk/2026/01/14/france_fines_free_free_mobile/
- Source link:
Free and Free Mobile are two separate businesses, respectively overseeing fixed-line and mobile services, owned by Iliad Group. The fines relate to an October 2024 breach that led to the data of more than 24 million individuals being compromised, including financial information such as IBANs.
In its judgment, CNIL noted that the attack began on September 28, 2024, and the companies were made aware of the intrusion on October 21 via a message from the attacker responsible. Free ousted the attacker from its systems the following day.
[1]
The attackers gained access to Free's network via the [2]company VPN before connecting to Free Mobile's subscriber management tool, MOBO. Even though the attacker only gained access to Free Mobile's application, MOBO, at the time, allowed users to search for the data belonging to customers of both Free and Free Mobile, including their IBANs, provided they were subscribers of services.
[3]
[4]
A post-mortem of the attack revealed that the attacker began exfiltrating customer records on October 6, 2024, including those related to the total 24,633,469 fixed and mobile contracts. This was broken down into 19,460,891 Free Mobile contacts and 5,172,577 Free contracts.
At the time of the attack, Free Mobile had around 15.5 million subscribers, while Free had approximately 7.6 million. The companies were fined €27 million ($31.4 million) and €15 million ($17.4 million), respectively, based on Iliad's €10 billion turnover and €367 million profit posted in 2024.
[5]
The regulator said that the companies contravened [6]GDPR in three ways: by failing to properly secure personal data, failing to adequately communicate the breach to those affected, and failing to comply with data retention laws.
Announcing the fine, CNIL [7]said : "The restricted panel found that on the day of the data breach, the companies had not implemented certain basic security measures that could have made the attack more difficult.
[8]EU's reforms of GDPR, AI slated by privacy activists for 'playing into Big Tech's hands'
[9]Europe's data protection laws cut data storage by making information-wrangling pricier
[10]UK watchdog urged to probe GDPR failures in Home Office eVisa rollout
[11]EU's reforms of GDPR, AI slated by privacy activists for 'playing into Big Tech's hands'
"In particular, it noted that the authentication procedure for connecting to the VPN of Free Mobile and to that of Free – used especially for remote work by the company's employees – was not sufficiently robust.
"Furthermore, the measures deployed by Free Mobile and Free to detect abnormal behavior on their information systems were ineffective."
The nature of the data that was stolen came into consideration when deciding the fine, as did the companies' data retention policies.
[12]
CNIL noted that both Free and Free Mobile lacked the necessary capabilities to sort former subscribers' data in a way that retained only the necessary information for accounting purposes.
They also lacked an adequate data-deletion mechanism at the time of the attack, and when it came to notifying their users about the attack, the initial email lacked key details users needed for a comprehensive understanding of its consequences. ®
Get our [13]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWlxnQikQXIQDYnSZ2DnyQAAARg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2025/10/28/cisco_citrix_vpn_ransomware/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxnQikQXIQDYnSZ2DnyQAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWlxnQikQXIQDYnSZ2DnyQAAARg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxnQikQXIQDYnSZ2DnyQAAARg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/11/11/eu_leaked_gdpr_ai_reforms/
[7] https://www.cnil.fr/fr/sanction-free-2026
[8] https://www.theregister.com/2025/11/11/eu_leaked_gdpr_ai_reforms/
[9] https://www.theregister.com/2024/02/21/gdpr_data_processing_costs/
[10] https://www.theregister.com/2025/12/12/ico_home_office_evisa/
[11] https://www.theregister.com/2025/11/11/eu_leaked_gdpr_ai_reforms/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWlxnQikQXIQDYnSZ2DnyQAAARg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
This one was reported more than 1 year ago, it's only the fine that was issued today.
Booooo...
Europe picking on poor hard done by US companies, better raise the tarrifs?
Oh wait, the law applies to non-US companies as well? But, but, but Europe only attacks poor hard done by multi-billion dollar US companies, Donald told me so.
This is crazy, the fine amounts to only 0.42% of turnover (11.4% of profit) and is barely above the 20 million max they'd have to pay if 4% of their turnover was less than that. I also wouldn't be surprised if they contest this and it ends up being reduced to an even lower amount. One wonders just how egregiously a company has to fuck up to actually get a fine of 4%.
They have indeed announced they will appeal to the Conseil d'etat, France's top administrative law court.
World's smallest violin, etc.
€42 / 24 = €1.75 for each customer affected - all of whom now have the risk of fraud using the leaked details...
I'm already getting spam on the, fortunately throwaway, email address they had.
Yeah, I got my initial math wrong and thought they had indeed been hit with a 4% fine, which I believe would have been a first for GDPR fines.
That said, the leaked data was not considered sensitive as per GDPR criteria (even bank details are not), so it was probably a mitigating factor, because they have no excuses for poor security measures and late notification.
€1.75 by each person breach? What a bargain!
And this leak is actively exploited. I've received quite a few targeted phishing emails since, using my actual bank logo, or from "Prime Video" including my full name, address and bank information. The only revealing detail was the bogus sending email address, a technical detail which many MUAs hide.
I'm sure it comes from that leak as they're using the unique email address I created for Free.
Free is generally less bad than the others but they really fucked this one up.
Looks like it's open season, that's four data breaches reported just today.
I'd go back to paper billing if my data weren't held in the same database reachable from the Internet for everyone who uses online billing.