FRFree data breach
Free (free.fr) suffered a data breach on 17 October 2024. Here is what leaked, how to find out whether you are affected, and what to do.
Indicative guide: high if passwords, bank details, ID documents or health data leaked; medium if a phone number, address or date of birth; low otherwise.
- Breach date
- 17 October 2024
- Accounts affected
- 13,926,173
- Types of data
- 6
- Known to HIBP since
- 27 May 2025
What leaked
Are you affected?
Search for your email address on Have I Been Pwned: if it appears in the Free breach, your data are part of it. Your email never goes through ShredRGPD.
Search for my email (new tab)Breach page on HIBP (new tab)
What the CNIL held against Free
According to the CNIL, the attacker reached the data of 24 million subscriber contracts, including the IBAN of people who were customers of both Free and Free Mobile. The number shown above comes from Have I Been Pwned, which counts the email addresses found, not the contracts.
In two decisions of 8 January 2026, published on 14 January, the CNIL imposed fines totalling €42 million: €27 million on Free Mobile and €15 million on Free, for insufficient security measures and an incomplete information email. Free Mobile was also fined for keeping more than 15 million contracts terminated more than five years earlier, some more than ten years earlier. Free announced an appeal to the Conseil d’État.
Former customer? Now is the time to write
If you left Free, even long ago, your data may still have been there. Send an erasure request (Article 17) so that nothing is left.
You are still a customer: first ask what leaked (Article 15). If your IBAN leaked, watch your direct debits. A direct debit you never authorised can be disputed with your bank up to 13 months after the debit; an authorised one, within 8 weeks. Nobody from Free or your bank will ask you for a code received by text message.
What to do now?
Your action plan
0 / 4 doneYour progress stays in this browser.
A message that mentions the breach, a call “from your bank”? See what to do on What to do?.
Write to Free
The GDPR lets you ask the company what data it holds about you and what leaked (Articles 15 and 34), or to erase your data (Article 17). It has one month to reply (Article 12(3)).
Ask what leakedRequest erasure
Data protection contact: dpo@iliad.fr (source (new tab), checked on 7 October 2026).
Frequently asked questions
How much was Free ordered to pay for the 2024 breach?
€42 million in total: €27 million for Free Mobile and €15 million for Free, in CNIL decisions of 8 January 2026. Free announced an appeal.
Did my IBAN leak at Free?
According to the CNIL, yes if you were a customer of both Free (internet box) and Free Mobile. Watch your direct debits and dispute with your bank any direct debit you did not authorise.
I am no longer a Free customer: are my data still kept?
Perhaps: the CNIL found more than 15 million contracts at Free Mobile that had been terminated more than five years earlier. Request erasure under Article 17 GDPR.
Sources
- CNIL, €42M fine (January 2026, in French) (new tab)
- Le Monde du Droit, January 2026 (in French) (new tab)
- Univers Freebox, Free’s appeal (in French) (new tab)
- Banque de France, disputed direct debits (13 months, 8 weeks) (new tab)
Information gathered on 13 October 2026.
Information: Have I Been Pwned (new tab), under the CC BY 4.0 (new tab) licence, updated on 30 October 2026. This is public information about the breach, not the breached data. Logos provided by Have I Been Pwned. Trademarks belong to their owners; ShredRGPD has no connection with these companies.