CNIL fines Free Mobile and Free €42 million after a 2024 breach exposed 24 million contracts

France’s CNIL issued two sanctions against Free Mobile and Free, totaling €42 million, after an attacker was able to access the personal data of no less than 24 million subscribers. The sensitive information included financial data, such as bank account identifiers (IBANs), making this incident particularly severe and resulting in thousands of customer complaints. In its official statement, the CNIL said that fundamental data security protection measures were lacking, creating relevant weaknesses in VPN access authentication, as well as abnormal behavior monitoring. 

‍

The authority acknowledged the companies’ efforts to improve these and other measures following the incident and investigation. While the companies did reach out to CNIL to report the incident, the authority stated that they did not include the full information required by the GDPR.

‍