[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbjIpRLFPKZ7_aaQzBaJ8LGc1UmMJ-pqpiCb-a-y6cOE":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"c936fe2c-ec3c-48c4-a3d7-ed7644182ba7","Data breach: FREE MOBILE and FREE fined €42 million","data-breach-free-mobile-and-free-fined-42-million-6d099a","Data breach: FREE MOBILE and FREE fined €42 million ipayotfr Fri, 21\u002F08\u002F2026 - 10:42","French regulators have fined FREE MOBILE and FREE a combined €42 million for a data breach that exposed the personal data of 24 million subscribers, including IBANs. The CNIL found that the companies failed to implement adequate security measures, such as robust VPN authentication and effective detection of abnormal system behavior. Additionally, their notification to affected individuals about the breach was incomplete.","FREE MOBILE and FREE fined €42 million for data breach impacting 24 million subscribers.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fdata-breach-free-mobile-and-free-fined-eur42-million_en",null,"2026-08-21T08:42:53+00:00","2026-08-21T10:00:13.296179+00:00",8,[17,20,22],{"name":18,"type":19},"FREE MOBILE","vendor",{"name":21,"type":19},"FREE",{"name":23,"type":24},"VPN","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":12,"name":27,"slug":28},"Policy","policy",[30,35,40,42],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":41},{"id":25,"icon":12,"name":27,"slug":28},{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":50,"vendors":135},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":110,"name":111,"problem":112,"products":113},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":123,"product_name":124,"url":125,"description":126},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":155},"free-mobile-42m-cnil-fine-weak-auth-poor-breach-notification","FREE Mobile €42M CNIL Fine: Weak Auth & Poor Breach Notification","French telecoms FREE MOBILE and FREE were fined a combined €42 million after a data breach exposed the personal data of 24 million subscribers, including sensitive financial identifiers (IBANs). The CNIL determined that the companies lacked robust VPN authentication controls, meaning attackers could exploit weak entry points to access internal systems. Equally critical, the companies failed to detect abnormal system behavior in a timely manner, suggesting inadequate monitoring and alerting capabilities. Compounding the harm, affected individuals were not fully notified about the breach, violating GDPR transparency obligations and leaving subscribers unable to protect themselves from downstream fraud.",[141,142,143,144,145,146,147,148,149,150,151,152,153,154],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of breach to supervisory authority","GDPR Article 34 – Communication of breach to data subjects","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-2 – Multi-Factor Authentication","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 IR-6 – Incident Reporting","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","ISO\u002FIEC 27001 Annex A.9 – Access Control","ISO\u002FIEC 27001 Annex A.12.4 – Logging and Monitoring",{}]