Free SAS
Approved Evidence
Added to Rotten Company: 8/29/2026
Conduct/Event period: October 2024–October 2024
Ongoing: No
Resolution status: Resolved
Resolution date: January 13, 2026
CNIL fined Free SAS €15 million for security failures linked to a major 2024 data breach
Summary
On 13 January 2026, France's data-protection authority CNIL fined Free SAS €15 million after finding GDPR security and retention violations associated with an October 2024 cyberattack. CNIL reported that information concerning 24 million mobile and fixed-line contracts was exfiltrated across Free SAS and the separately sanctioned Free Mobile entity, including bank details for some contracts. This record attributes only Free SAS's €15 million sanction; it does not attribute Free Mobile's separate €27 million fine to Free SAS. Primary source: https://www.cnil.fr/fr/sanction-free-2026
Evidence Weight
99.46
Severity: high
Recency Weight: 99.45806646729451
File Weight: 1