Data breach: FREE MOBILE and FREE fined €42 million
FREE MOBILE and FREE fined €42 million for data breach impacting 24 million subscribers.
Summary
French regulators have fined FREE MOBILE and FREE a combined €42 million for a data breach that exposed the personal data of 24 million subscribers, including IBANs. The CNIL found that the companies failed to implement adequate security measures, such as robust VPN authentication and effective detection of abnormal system behavior. Additionally, their notification to affected individuals about the breach was incomplete.
Full text
Data breach: FREE MOBILE and FREE fined €42 million National News 02 February 2026 fr Background informationDate of final decision: 13 January 2026National caseController: FREE MOBILE and FREELegal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Article 5 (Principles relating to processing of personal data)Decision: Administrative fineKey words: Administrative fine, Data security, Data breachSummary of the DecisionOrigin of the caseIn October 2024, an attacker managed to infiltrate the companies' information system and access personal data relating to 24 million subscriber contracts, including IBANs for individuals who were customers of both FREE MOBILE and FREE.Following a large number of complaints (more than 2,500 to date) from individuals affected by this data breach, the CNIL carried out an inspection which revealed breaches of several obligations under the GDPR attributable to FREE MOBILE and FREE, each of which is the data controller for its own subscribers.Key FindingsBreach of the obligation to secure personal data (Article 32 of the GDPR) – FREE and FREE MOBILEThe restricted committee found that, on the day of the data breach, the companies had not implemented certain basic security measures that could have made the attack more difficult. In particular, it noted that the authentication procedure for connecting to the VPNs of FREE MOBILE and FREE – used in particular for remote working by the companies' employees – was not sufficiently robust. Furthermore, the measures deployed by FREE MOBILE and FREE to detect abnormal behaviour on their information systems were ineffective.Breach of the obligation to notify data subjects of the data breach (Article 34 of the GDPR) – FREE and FREE MOBILEThe email sent to inform individuals about the data breach did not contain all the necessary information referred to in paragraph 2 of Article 34 of the GDPR, ruling that these omissions did not allow the individuals concerned to directly understand the consequences of the breach, nor the measures they could take to protect themselves from them.Breach by FREE MOBILE of its obligation to retain personal data for a limited period (Article 5-1-e of the GDPR) – FREE MOBILE onlyOn the date of the inspection, the company had not implemented measures to sort the data of former subscribers in order to retain only those necessary for accounting purposes and then delete them when their retention was no longer necessary.DecisionAs a result, the restricted committee – the CNIL body responsible for imposing sanctions – imposed a fine of €27 million on FREE MOBILE and a fine of €15 million on FREE, taking into account in particular their financial capacities, their lack of knowledge of essential security principles, the number of people affected and the "highly" personal nature of the data concerned, as well as the risks posed by the breach of certain data (IBAN). Relevant topics Personal data breaches Fines Latest news EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: express your interest30 July 2026 EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: save the date23 July 2026 EDPB News EDPB calls for legal basis for cross-regulatory information sharing17 July 2026All news