French Regulators Slap Free Mobile with €42 Million Fine for 2024 Data Breach

France Fines Free Mobile €42 Million for 2024 Data Breach

The French data protection authority, CNIL, has levied fines totaling €42 million on Free Mobile and its parent company, Free, for failing to adequately safeguard customer data from cyber threats.

Free Mobile, the second-largest internet service provider in France, fell victim to a data breach in October 2024, compromising the personal information of nearly 23 million mobile and fixed subscribers.

The breach targeted the company’s management tool, with hackers stealing sensitive customer data to sell on a hacker forum. The perpetrators, using the alias ‘drussellx’, claimed that the attack affected 19.2 million customers and included IBANs for approximately 25% of those individuals.

Following an investigation, CNIL determined that despite Free’s efforts to enhance cybersecurity post-breach, their prior negligence breached several GDPR regulations.

“CNIL’s inspection, prompted by over 2,500 complaints from affected individuals, revealed numerous GDPR violations by Free Mobile and Free,” the French agency stated.

The violations identified were:

1. Failure to ensure data security (Article 32 GDPR) – Inadequate security measures, including weak VPN authentication and ineffective abnormal activity detection, facilitated the breach.
2. Failure to notify affected individuals adequately (Article 34 GDPR) – Notifications lacked detail on breach consequences and mitigation steps.
3. Excessive retention of personal data (Article 5(1)(e) GDPR) – Free Mobile retained former subscribers’ data longer than necessary, failing to delete it in a timely manner.

CNIL mandated both companies to finalize their enhanced security measures within three months and instructed Free Mobile to remove excess customer data within six months.

Subsequent to the Free Mobile breach, France witnessed additional data breaches impacting major telecommunication providers.

In July 2025, Orange France reported a breach causing operational disruptions, while Bouygues Telecom suffered a breach exposing sensitive data of 6.4 million customers a month later.

As MCP (Model Context Protocol) gains traction for LLM connectivity, security teams are prioritizing safeguarding new services. Download our free cheat sheet detailing 7 best practices for immediate use.

Download Now