CNIL fined Free SAS €15 million for security failures linked to a major 2024 data breach
Company: Free SAS
Summary
On 13 January 2026, France's data-protection authority CNIL fined Free SAS €15 million after finding GDPR security and retention violations associated with an October 2024 cyberattack. CNIL reported that information concerning 24 million mobile and fixed-line contracts was exfiltrated across Free SAS and the separately sanctioned Free Mobile entity, including bank details for some contracts. This record attributes only Free SAS's €15 million sanction; it does not attribute Free Mobile's separate €27 million fine to Free SAS. Primary source: https://www.cnil.fr/fr/sanction-free-2026