France fines telcos €42M for issues leading to 2024 breach

The French data protection regulator, CNIL, today issued a collective €42 million ($48.9 million) fine to two French telecom companies for GDPR violations stemming from a data breach.

Free and Free Mobile are two separate businesses, respectively overseeing fixed-line and mobile services, owned by Iliad Group. The fines relate to an October 2024 breach that led to the data of more than 24 million individuals being compromised, including financial information such as IBANs.

In its judgment, CNIL noted that the attack began on September 28, 2024, and the companies were made aware of the intrusion on October 21 via a message from the attacker responsible. Free ousted the attacker from its systems the following day.

A post-mortem of the attack revealed that the attacker began exfiltrating customer records on October 6, 2024, including those related to the total 24,633,469 fixed and mobile contracts. This was broken down into 19,460,891 Free Mobile contacts and 5,172,577 Free contracts.

The regulator said that the companies contravened GDPR in three ways: by failing to properly secure personal data, failing to adequately communicate the breach to those affected, and failing to comply with data retention laws.

Announcing the fine, CNIL said : "The restricted panel found that on the day of the data breach, the companies had not implemented certain basic security measures that could have made the attack more difficult.

"In particular, it noted that the authentication procedure for connecting to the VPN of Free Mobile and to that of Free – used especially for remote work by the company's employees – was not sufficiently robust.

"Furthermore, the measures deployed by Free Mobile and Free to detect abnormal behavior on their information systems were ineffective."

The nature of the data that was stolen came into consideration when deciding the fine, as did the companies' data retention policies.

They also lacked an adequate data-deletion mechanism at the time of the attack, and when it came to notifying their users the attack, the initial email lacked key details users needed for a comprehensive understanding of its consequences. ®