Free fined €15M by the CNIL after a 24M-contract breach
€15M
≈ $17.4M at the time
CNIL
France · 2026
Status: Not yet final
What happened
The CNIL found that Free, the broadband operator, did not secure its subscribers' data to a level matching its volume and sensitivity, with weak VPN authentication and ineffective detection of abnormal activity, after an attacker reached the systems of Free and Free Mobile in October 2024. It also found that the breach notice sent to subscribers lacked required information on the consequences and on how to protect themselves.
Free must complete new security measures within three months. The companion decision against Free Mobile (SAN-2026-001, €27M) brings the combined penalty to €42M.
How it affected users
Data on about 24 million subscriber contracts across Free and Free Mobile was accessed, including IBANs of people who were customers of both. Each company answers for its own subscribers' data.
Status timeline
Jan 8, 2026
The CNIL's restricted committee adopted deliberation SAN-2026-002: a €15M fine for breaching Articles 32 and 34 GDPR, with a security order backed by a €25,000 daily penalty for delay.
Jan 14, 2026
Decision published. Free announced that it had taken the case to the Conseil d'État.
Sources
- CNIL: Violation de données, sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREEregulator
- Légifrance: Délibération de la formation restreinte n° SAN-2026-002 du 8 janvier 2026 (FREE)regulator
- Le Club des Juristes: La CNIL inflige une amende de 42 millions d'euros à Freenews
Last verified 2026-10-29. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Free fined €15M by the CNIL after a 24M-contract breach," Tech Fines Directory, guptadeepak.com, 2026-01-14. https://guptadeepak.com/tech-fines/violation/free-france-cnil-2026/