France fines telcos €42M for sub-par security prior to 24M customer breach

CNIL fined Iliad-owned Free and Free Mobile a combined €42 million after an October 2024 breach exposed personal and financial data for approximately 24.6 million contracts. Attackers accessed Free's network via the company VPN, used the MOBO subscriber management tool to query both fixed and mobile customer records (including IBANs), and began exfiltrating records on October 6; the intrusion was discovered on October 21 and removed on October 22. The regulator cited weak VPN authentication, ineffective detection of abnormal activity, and inadequate data-retention/deletion processes and breach notifications when determining the sanctions.