Free SAS, France's second largest internet service provider, confirmed in late October 2024 that attackers had compromised an internal management tool and taken subscriber data. The company serves more than 20 million Free Mobile and Freebox customers.
Days earlier a user on a criminal forum had advertised two databases, dating the access to 17 October 2024 and claiming records covering 19.2 million accounts in a set of about 43.6 gigabytes. The listing described names, email and postal addresses, dates of birth, mobile numbers, customer identifiers and service details, along with more than 5.1 million IBAN bank identifiers belonging to Freebox subscribers. The data was put up for auction rather than sold at a fixed price.
Free said no passwords, payment card details or the contents of calls, messages and voicemail were affected, and that its services continued to operate normally. It notified the French cyber authorities and the data protection regulator and said it would contact affected subscribers by email. The company did not confirm how many customers were involved or endorse the seller's figures.
Free told customers that an IBAN alone cannot be used to withdraw funds but can support phishing and fraudulent direct debits, and urged them to check their statements. At least one French researcher publicly cautioned that the seller's account was newly created and the claims should be treated sceptically until independently verified.