Background information

• Date of final decision: 13 January 2026
• National case
• Controller: FREE MOBILE and FREE
• Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Article 5 (Principles relating to processing of personal data)
• Decision: Administrative fine
• Key words: Administrative fine, Data security, Data breach

Summary of the Decision

Origin of the case

In October 2024, an attacker managed to infiltrate the companies' information system and access personal data relating to 24 million subscriber contracts, including IBANs for individuals who were customers of both FREE MOBILE and FREE.

Following a large number of complaints (more than 2,500 to date) from individuals affected by this data breach, the CNIL carried out an inspection which revealed breaches of several obligations under the GDPR attributable to FREE MOBILE and FREE, each of which is the data controller for its own subscribers.

Key Findings

• Breach of the obligation to secure personal data (Article 32 of the GDPR) – FREE and FREE MOBILE
  The restricted committee found that, on the day of the data breach, the companies had not implemented certain basic security measures that could have made the attack more difficult. In particular, it noted that the authentication procedure for connecting to the VPNs of FREE MOBILE and FREE – used in particular for remote working by the companies' employees – was not sufficiently robust. Furthermore, the measures deployed by FREE MOBILE and FREE to detect abnormal behaviour on their information systems were ineffective.
• Breach of the obligation to notify data subjects of the data breach (Article 34 of the GDPR) – FREE and FREE MOBILE
  The email sent to inform individuals about the data breach did not contain all the necessary information referred to in paragraph 2 of Article 34 of the GDPR, ruling that these omissions did not allow the individuals concerned to directly understand the consequences of the breach, nor the measures they could take to protect themselves from them.
• Breach by FREE MOBILE of its obligation to retain personal data for a limited period (Article 5-1-e of the GDPR) – FREE MOBILE only

On the date of the inspection, the company had not implemented measures to sort the data of former subscribers in order to retain only those necessary for accounting purposes and then delete them when their retention was no longer necessary.

Decision

As a result, the restricted committee – the CNIL body responsible for imposing sanctions – imposed a fine of €27 million on FREE MOBILE and a fine of €15 million on FREE, taking into account in particular their financial capacities, their lack of knowledge of essential security principles, the number of people affected and the "highly" personal nature of the data concerned, as well as the risks posed by the breach of certain data (IBAN).