CNIL fines FREE MOBILE and FREE €42 million for data breach affecting 24 million subscribers

Original title: Data breach: FREE MOBILE and FREE fined €42 million

The CNIL issued combined fines of €42 million against FREE MOBILE and FREE following a January 2026 decision regarding an October 2024 data breach that exposed personal data of 24 million subscriber contracts, including IBANs. The companies violated GDPR Articles 32 (security of processing), 34 (breach notification), and Article 5(1)(e) (data retention), with specific failures including weak VPN authentication procedures, ineffective anomaly detection systems, incomplete breach notification communications, and FREE MOBILE's failure to implement data retention controls. The fines reflected the companies' inadequate security practices, lack of essential security knowledge, the number of affected individuals, and the sensitive nature of exposed data including financial information.

What changed

• Breach of Article 32 (Security of processing): FREE MOBILE and FREE failed to implement basic security measures at the time of the breach, particularly weak authentication procedures for VPN access used for remote work and ineffective systems for detecting abnormal behaviour on their information systems.
• Breach of Article 34 (Breach notification): The notification emails sent to affected individuals did not contain all information required under Article 34(2) of the GDPR, preventing individuals from understanding the consequences of the breach and protective measures they could take.
• Breach of Article 5(1)(e) (Data retention limitation): FREE MOBILE did not implement measures to sort and delete former subscribers' data no longer necessary for accounting purposes, retaining personal data beyond the required period.
• Administrative sanctions imposed: €27 million fine on FREE MOBILE and €15 million fine on FREE, totalling €42 million, based on financial capacity, lack of security knowledge, number of affected individuals, and sensitive nature of exposed data including IBANs.

Who is affected

Telecommunications service providers (FREE MOBILE and FREE) in France; 24 million subscriber contracts affected; individuals holding subscriber contracts including those with associated IBAN data.

Summary generated by a language model; the official text prevails. Not legal advice.