Cybersecurity Lapses Cost Free Mobile 42 Million in Data Breach Fines
In a significant move, the French data protection authority (CNIL) has fined Free Mobile and its parent company, Free, a total of 42 million euros for inadequate protection of customer data against cyber threats. This penalty follows a data breach incident in October 2024, affecting nearly 23 million mobile and fixed subscribers.
Negligence Leads to GDPR Violations
An investigation by the CNIL revealed several violations of the General Data Protection Regulation (GDPR) by Free Mobile and Free. These violations included inadequate security measures, insufficient information provided to affected individuals, and excessive retention of personal data.
- Inadequate Security Measures: The companies had weak VPN authentication for employees' remote access and ineffective detection of abnormal activity, enabling the attack.
- Insufficient Information: The emails sent to users lacked detailed information and did not clearly explain the consequences of the breach or what steps should be taken to mitigate the risk.
- Excessive Retention: Free Mobile kept personal data of millions of former subscribers for an extended period, beyond what was necessary.
Implications for the Telecommunications Industry
The data breach at Free Mobile is not an isolated incident in France. In July 2025, Orange France and Bouygues Telecom also suffered breaches, exposing sensitive data of millions of customers. These incidents highlight the importance of robust cybersecurity measures in the telecommunications industry.
For Northeast India, which is rapidly expanding its telecommunications infrastructure, these incidents serve as a reminder of the need for stringent data protection measures. As more personal data is collected and stored, the risk of breaches increases, underscoring the importance of investing in cybersecurity.
Looking Forward
The fines imposed on Free Mobile and Free serve as a warning to other companies to prioritize cybersecurity and comply with data protection regulations. As we move forward, it is crucial for organizations to invest in secure systems, educate employees about cyber threats, and promptly respond to any security incidents.