Data breach: FREE MOBILE and FREE fined €42 million
FREE MOBILE and FREE fined €42 million for data breach impacting 24 million subscribers.
French regulators have fined FREE MOBILE and FREE a combined €42 million for a data breach that exposed the personal data of 24 million subscribers, including IBANs. The CNIL found that the companies failed to implement adequate security measures, such as robust VPN authentication and effective detection of abnormal system behavior. Additionally, their notification to affected individuals about the breach was incomplete.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FREE MOBILE?
Get an email when a new story names FREE MOBILE, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFrench telecoms FREE MOBILE and FREE were fined a combined €42 million after a data breach exposed the personal data of 24 million subscribers, including sensitive financial identifiers (IBANs). The CNIL determined that the companies lacked robust VPN authentication controls, meaning attackers could exploit weak entry points to access internal systems. Equally critical, the companies failed to detect abnormal system behavior in a timely manner, suggesting inadequate monitoring and alerting capabilities. Compounding the harm, affected individuals were not fully notified about the breach, violating GDPR transparency obligations and leaving subscribers unable to protect themselves from downstream fraud.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.