[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ6TfCf_yrgi64j-eez22Kog1siLnLADXNzKB7MxFilM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"774899b0-6d01-43ad-8878-225b314ac653","free-mobile-42m-cnil-fine-weak-auth-poor-breach-notification","c936fe2c-ec3c-48c4-a3d7-ed7644182ba7","FREE Mobile €42M CNIL Fine: Weak Auth & Poor Breach Notification","French telecoms FREE MOBILE and FREE were fined a combined €42 million after a data breach exposed the personal data of 24 million subscribers, including sensitive financial identifiers (IBANs). The CNIL determined that the companies lacked robust VPN authentication controls, meaning attackers could exploit weak entry points to access internal systems. Equally critical, the companies failed to detect abnormal system behavior in a timely manner, suggesting inadequate monitoring and alerting capabilities. Compounding the harm, affected individuals were not fully notified about the breach, violating GDPR transparency obligations and leaving subscribers unable to protect themselves from downstream fraud.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all VPN and remote access entry points without exception.\n- Audit all existing VPN configurations and credentials to identify and revoke weak or default authentication settings.\n\n**Detection & Monitoring improvements:**\n- Deploy a SIEM solution with baseline behavioral analytics to automatically flag anomalous access patterns and data exfiltration attempts.\n- Establish 24\u002F7 alerting thresholds for unusual data volumes or off-hours access to systems holding sensitive personal data (including financial data such as IBANs).\n\n**Long-term & Compliance measures:**\n- Develop and rehearse a breach notification runbook that meets GDPR Article 33 (72-hour regulator notification) and Article 34 (individual notification) requirements.\n- Conduct annual third-party penetration tests specifically targeting authentication mechanisms and network access controls.\n- Implement a formal data classification policy to ensure that high-sensitivity data (e.g., IBANs, PII) receives elevated security controls and access restrictions.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of breach to supervisory authority","GDPR Article 34 – Communication of breach to data subjects","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-2 – Multi-Factor Authentication","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 IR-6 – Incident Reporting","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","ISO\u002FIEC 27001 Annex A.9 – Access Control","ISO\u002FIEC 27001 Annex A.12.4 – Logging and Monitoring",{},"published","2026-08-21T10:21:13.070338+00:00","2026-08-21T10:21:12.988+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fdata-breach-free-mobile-and-free-fined-eur42-million_en","data-breach-free-mobile-and-free-fined-42-million-6d099a","Data breach: FREE MOBILE and FREE fined €42 million",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",[],[55,59,63],{"slug":56,"name":57,"problem":58},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":64,"name":65,"problem":66},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]