FREE MOBILE and FREE Hit with €42 Million in GDPR Fines Over Massive Data Breach On 13 January 2026, France’s data protection authority, the CNIL, imposed €42 million in fines on telecom operators FREE MOBILE (€27 million) and FREE (€15 million) for failing to secure subscriber data, following a 2024 cyberattack that exposed sensitive information of 24 million customers. The breach, discovered in October 2024, allowed an attacker to infiltrate the companies’ systems and access personal data, including IBANs, from millions of subscriber contracts. Over 2,500 complaints prompted a CNIL investigation, which uncovered multiple GDPR violations, including inadequate security measures, delayed breach notifications, and excessive data retention. ### Key Failures Identified by CNIL 1. Weak Security Measures (Article 32 GDPR) - The companies lacked basic protections, such as robust VPN authentication and effective anomaly detection, making the attack easier to execute. - While FREE MOBILE and FREE later strengthened security, the CNIL ordered them to complete these measures within three months. 2. Incomplete Breach Notifications (Article 34 GDPR) - Affected customers received two-tiered communications an email and a toll-free number but the initial email omitted critical details, leaving victims unaware of the full risks and protective steps. 3. Excessive Data Retention (Article 5-1-e GDPR – FREE MOBILE Only) - FREE MOBILE failed to purge outdated subscriber data, retaining millions of records without legal justification. The CNIL ordered the company to complete data sorting and deletion within six months. ### Impact and CNIL’s Rationale The fines reflect the scale of the breach, the sensitivity of exposed data (IBANs), and the companies’ financial capacity. The CNIL emphasized that while no security is foolproof, FREE MOBILE and FREE’s lack of fundamental safeguards unnecessarily increased risks for millions of users. Both companies have since begun remediation efforts, though the CNIL’s deadlines remain in effect.