Free held 24 million customers' bank details too long. A breach cost it €42M.

In October 2024 an attacker infiltrated the information systems of Free and Free Mobile, the two telecom arms of Xavier Niel's Iliad group, and reached the personal data of 24 million subscriber contracts — including the bank account numbers, or IBANs, of customers who used both services. It was one of the largest breaches of a French consumer brand. More than 2,500 of those customers complained to the data-protection regulator, the CNIL.

When the CNIL ruled, on 13 January 2026, it fined the two companies €42 million in total — €27 million for Free Mobile and €15 million for Free. The regulator's findings went beyond the hack itself. Free Mobile, it said, had kept millions of subscriber records for far longer than it had any reason to, breaching the GDPR rule that data be held only as long as needed. The bigger the hoard, the bigger the breach.

The security failings were specific. The VPN used to access the systems was not authenticated robustly enough; the tools meant to spot abnormal behaviour did not work; the measures protecting confidentiality were inadequate. In other words, the data was both over-collected and under-guarded.

Then came the part that made it a brand failure rather than an IT one. Free's email notifying customers of the breach, the CNIL found, left out information people needed — it did not let them understand the consequences or what to do to protect themselves. A company that holds 24 million customers' bank details and then cannot tell them clearly what was taken has failed at the relationship, not just the firewall.