Leak at Free

On 25 October 2024, Free — France's second-largest telecoms operator, part of the Iliad group — confirmed a cyberattack against its information systems after a threat actor contacted the company and announced the theft of subscriber data. Investigators later established that the intruders had reached an internal subscriber-management tool (MOBO), reportedly after gaining access through the company VPN, which let them query records belonging to both Free and Free Mobile customers.

The attacker put two datasets up for sale on a cybercrime forum: a large set covering Free Mobile accounts and a separate set of roughly 5.1 million Free fixed-line records that critically included banking IBANs. The stolen data was subsequently auctioned and reportedly sold for around 175,000 dollars. Free stated that no passwords, bank-card numbers, or communication content were compromised.

Exposed data categories included:

• Last name and first name
• Date and place of birth
• Email and postal address
• IBAN (bank account number)
• Subscriber identifier, plan type, subscription date, and active-subscription status

Free filed a criminal complaint and notified the French regulators CNIL and ANSSI, stating that mitigation measures were applied immediately. The incident was contained, but in January 2026 the CNIL fined Free and Free Mobile a combined 42 million euros for failing to adequately secure the data, notify affected users, and comply with data-retention rules.