Skip to content
HACKTECH
RegulationReported Published 5 sources

CNIL fines Free Mobile and Free €42 million over security failures behind 2024 breach

France's data protection authority, the CNIL, said on 14 January 2026 that it had fined Free Mobile €27 million and Free €15 million for inadequate security of subscriber data. According to the CNIL, an attacker who infiltrated the companies' systems in October 2024 accessed personal data relating to 24 million subscriber contracts, including IBANs. The regulator found VPN authentication that was not strong enough, ineffective detection of abnormal behaviour, breach notification emails missing required information and, at Free Mobile, excessive retention of former subscribers' data.

  • CNIL
  • GDPR
  • fines
  • VPN
  • MFA
  • breach notification
  • France

What the sources report

  • The breaches concern GDPR Article 32 (security), Article 34 (notifying data subjects) and, for Free Mobile, Article 5(1)(e) (storage limitation). The CNIL said it issued the decisions on 13 January 2026; the deliberations, SAN-2026-001 (Free Mobile) and SAN-2026-002 (Free), are dated 8 January 2026 and published on Légifrance.
  • The CNIL said the VPN authentication procedure, used in particular for employees' remote working, was not strong enough, and the measures to detect abnormal behaviour on the information systems were ineffective.
  • According to the CNIL, the notification email lacked information required by Article 34(2) and did not let individuals directly understand the consequences of the breach or the steps they could take to protect themselves.
  • Both companies were ordered to complete their new security measures within three months, and Free Mobile to finish sorting and purging data within six months. The CNIL cited more than 2,500 complaints.
  • In a separate decision on 22 January 2026, the CNIL fined France Travail €5 million after attackers used social engineering to hijack CAP EMPLOI adviser accounts. It cited authentication that was not strong enough, inadequate logging and overly broad access rights.

What it means for your organisation

The CNIL's security findings against Free Mobile and Free concern VPN authentication that was not strong enough and detection that missed abnormal activity. The same month it fined France Travail €5 million for weak authentication of partner accounts, inadequate logging and access rights that, it said, increased the volume of data accessible to the attackers. The regulator also judged what the customer notification said and how long old subscriber data was kept, which brings breach communications and data retention into the scope of security reviews.

What we check

  • Test VPN and other remote-access gateways for MFA coverage, factor strength and any legacy or fallback authentication paths.
  • Run detection exercises that simulate misuse of internal management tools by valid accounts and bulk extraction of customer records.
  • Review breach notification templates against GDPR Article 34(2) and the CNIL's findings: a clear description of the breach, likely consequences, measures taken and steps individuals can take.
  • Audit customer databases for records kept beyond their retention period and confirm deletion jobs actually run.
  • Review access rights for support staff and partner accounts so each user can query only the records they need.

Sources

Services that cover these checks

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works