Free Mobile: a weak VPN login, a database France's regulator said should have been empty, and a €42 million fine

Background

Free (operating as Free Mobile for its wireless subscribers) is one of France's largest telecom operators, built in part on being the disruptive, lower-cost alternative to the legacy carriers. That scale is exactly what made its October 2024 breach significant: CNIL, France's data protection authority, ultimately found the exposure reached personal data tied to roughly 24 million subscriber contracts, including IBANs for a portion of them. Fourteen months later, CNIL handed down one of the largest fines in its history — and the decision reads less like a breach penalty and more like an audit of everything the company had let slide.

From a weak VPN login to a €42 million CNIL decision

What actually happened

On October 22, 2024, a security researcher publicized that a hacker using the name "drussellx" was selling a database on the cybercrime forum BreachForums, claiming it belonged to Free. The seller dated the underlying theft to October 17. Free confirmed the breach publicly on October 26 — company and regulator accounts of scope differ by source, and this case study presents both rather than picking one: CNIL's own sanction decision states the exposure reached personal data tied to about 24 million subscriber contracts, with IBANs compromised for some customers; the hacker's own sales listing separately claimed about 19.2 million customers and 5.11 million IBANs, covering both Free Mobile and Freebox internet subscribers. Free itself never confirmed the hacker's figure.

CNIL's investigation found the entry point was a weakness in the authentication protecting VPN access into Free's systems, paired with a failure to detect the resulting abnormal activity in time to stop it. The exact technical mechanism behind that authentication weakness — whether credential reuse, a missing second factor, or something else — has not been disclosed publicly by Free or detailed in CNIL's released findings. Free maintained that passwords, bank card numbers, and the content of customer communications were not accessed, and argued separately that the exposed IBANs alone could not be used to initiate a direct debit against a customer's account — a company characterization, not an independently verified technical claim.

What made the eventual fine so large wasn't only the breach. CNIL's investigation surfaced two further violations layered on top of the security failure. First, the breach-notification email Free sent to regulators was itself judged incomplete — missing information GDPR's Article 34 requires a notification to contain, meaning Free managed to violate the law a second time in the act of reporting that it had violated it the first time. Second, and specific to Free Mobile, CNIL found more than 2.8 million contracts belonging to customers who had left the service over a decade earlier were still sitting in the database that got breached — data with no remaining business purpose, kept anyway.

CNIL received more than 2,500 complaints tied to this breach — an unusually high volume that signals how directly customers felt this, not just an abstract regulatory statistic. On January 8, 2026, CNIL's formation restreinte (its sanctioning body) issued its decision, made public January 13 to 14: a combined €42 million fine, split €27 million against Free Mobile and €15 million against parent entity Free SAS, backed by ongoing daily penalties of €50,000 and €25,000 respectively if the underlying compliance measures CNIL ordered aren't implemented. Free has said it will appeal to the Conseil d'État, France's highest administrative court, challenging both the severity of the sanction and the decision to pursue two distinct group entities in a single proceeding. The appeal does not suspend the fine, and no ruling on it has been reported.

Root cause

Timeline

Detection

What to monitor for in your own environment

Containment, eradication & recovery

Security control analysis

Controls that would have prevented or limited this

Blast radius

How the €42 million fine was split

What they got right

Free confirmed the breach publicly within days of the researcher's disclosure, rather than staying silent while the stolen data circulated on a criminal forum.

Free's representations during CNIL's investigation were credited enough to be part of the regulatory settlement process, and the company has not disputed CNIL's core findings — it's appealing the severity and procedural structure of the sanction, not denying the underlying facts.

That said, this is a thinner list than most case studies in this series carry. CNIL's decision reads as a regulator that found a security failure, a non-compliant disclosure, and a data-retention violation all at once — there isn't much here to credit beyond confirming the breach happened and not contesting what CNIL found.

Why this keeps happening

VPN and remote-access authentication is one of the most consistently exploited entry points across telecom and large-enterprise breaches generally, precisely because it's designed to be convenient for a distributed workforce — the same property that makes it convenient for an attacker who gets past it.

Data retention sprawl — keeping records for customers who left years or a decade ago — is close to a universal, unaddressed risk across large organizations. Most companies have no active process forcing deletion once a legitimate business purpose ends, which is exactly the gap CNIL found and fined.

European regulators are increasingly treating the quality of breach disclosure as its own enforceable obligation, not a formality that follows the real violation. A notification that's technically sent but substantively incomplete is, under this reading, its own GDPR failure — a pattern worth watching for any organization operating under European data protection law.

Lessons for your own environment

1. A VPN's convenience is also its attack surface

   Remote access designed to be fast and frictionless for legitimate users is, by the same design, fast and frictionless for an attacker who gets past the authentication protecting it. Treat VPN and remote-access authentication strength as a standing audit item, not a one-time setup decision.

2. Detection has to catch abnormal activity, not just unauthorized access

   The attacker got in through a credential-level weakness, not a dramatic exploit. What let the breach reach 24 million contracts was that the abnormal activity following that access wasn't caught in time — detection tuned only to block entry misses everything that happens after.

3. Data with no business purpose is a liability sitting in wait

   Over 2.8 million contracts from customers gone for a decade were fined as their own violation, independent of the breach. Every record kept past its legitimate purpose is attack surface with no offsetting value — audit retention policy as its own project, not an afterthought of a breach response.

4. A breach-notification email can itself be a second violation

   CNIL didn't just fine the breach — it fined the notification about the breach for being incomplete. Have legal and compliance review your actual notification template against the specific content requirements your jurisdiction's law demands, before you need to send one under pressure.

5. Regulatory settlement and public dispute aren't mutually exclusive

   Free cooperated enough during the investigation to be part of CNIL's settlement process, and is still appealing the outcome. An organization can engage constructively with a regulator's findings while contesting the proportionality or process of the resulting penalty — those are different questions.

CISO & board lessons

• Treat GDPR's Article 32 security obligations and Article 34 notification-content requirements as two separate compliance surfaces requiring two separate audits — Free was found to have failed both, and failing the second compounded the first.
• Data minimization is a real, fineable legal exposure under GDPR, not a best-practice recommendation a board can deprioritize. Ask specifically how long your organization retains data for customers who've left, and whether that retention period has a documented, defensible business justification.
• Before any incident occurs, have legal and security jointly stress-test your actual breach-notification template against the specific content your regulator requires — not a generic "we experienced an incident" draft that looks complete but legally isn't.
• A regulator credits cooperation and remediation evidence during settlement negotiations, even when the fine is still severe. Build the muscle to engage constructively and produce real evidence during an investigation — the alternative (contesting every finding) rarely produces a better outcome and can cost the credit a settlement process offers.

Action plan

Could this happen in your organization?

• Does every VPN or remote-access entry point into systems holding customer data require multi-factor authentication, confirmed rather than assumed?
• Would your organization detect abnormal activity following a successful remote-access login, or only an unauthorized login attempt itself?
• Do you know how much data your organization holds for customers who left years ago, and whether any of it has a documented, defensible reason to still exist?
• Has your breach-notification template actually been checked against your jurisdiction's specific required content, by someone who would know if it's incomplete?
• If your organization were breached today, could you state with confidence what specific data categories were and weren't exposed — and could you back that statement up?
• Does your organization have an active, enforced process for deleting data once its legitimate business purpose ends, or does retention just continue by default?
• If a regulator proposed a fine larger than you expected, do you know whether your organization would contest the underlying findings or the severity of the penalty — and is that distinction already understood internally?

If this happened to you: what to ask, and what to say

Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.