Free free.fr Free data breach: what happened and what to do
In October 2024, hackers broke into the systems of Free, the French internet and mobile provider, and the data was later leaked. Have I Been Pwned lists about 13.9 million accounts with names, addresses, phone numbers, dates of birth, genders and, for many records, bank account numbers (IBANs).
View all 13,115 breaches- Breach date
- 17 Oct 2024
- Affected
- 13,926,173
- Data exposed
- Bank account numbers, Dates of birth, Genders, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2024, Free, one of France's largest internet and mobile providers, suffered a data breach. An attacker got into the company's systems, offered the stolen data for sale, and it was later leaked publicly. Have I Been Pwned added the leak to its database in May 2025 and counts 13,926,173 affected accounts, built from about 14 million unique email addresses.
France's data protection authority, the CNIL, later investigated. It says the attacker got into the company's information system and reached personal data tied to 24 million subscriber contracts, including IBANs. The two numbers measure different things (unique emails in the leak versus contracts in the regulator's findings), so don't expect them to match. According to reporting on the case, the attack went through a management tool that exposed subscriber data.
What was exposed
The leaked records contain names, physical addresses, phone numbers, genders and dates of birth. For many records they also contain IBANs, the international bank account number used for direct debits. Customer passwords, bank card details and the content of communications were not accessed, according to the reporting.
Free said the exposed bank details were "not enough to make a direct debit from a bank". That's broadly true: an IBAN alone doesn't let someone withdraw money, and debits in the SEPA system can be disputed. But a name, address, date of birth and IBAN together are a strong starting kit for fraud. Criminals use them to build convincing phone calls and emails that pose as Free or as your bank, and to try fake direct debit mandates.
What it means for you
A breach like this rarely leads to a single big theft. It leads to months of targeted scams. Expect messages that use your real name and address and claim to be from your provider, asking you to "verify" a payment or confirm your bank details. A leaked phone number also makes SIM-swap attempts easier, where someone convinces a mobile provider to move your number to their SIM. Your date of birth doesn't change, so it stays useful to criminals for years.
The company's response and the fine
Free confirmed the breach after the data appeared online. In 2026 the CNIL fined Free Mobile €27 million and Free €15 million, €42 million in total. The regulator also pointed to over-retention: the company kept data on millions of former subscribers for longer than necessary.
What Serus does here
You can't take leaked breach data back, and nobody can delete it from the places it was shared. What you can do is make it less useful and spot misuse early. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up, so you know when to act.
What to do if you were in it
- 1
Watch your bank statements and direct debits
Check your account for debits you don't recognize. In the SEPA system you can usually dispute an unauthorized direct debit with your bank for a limited period, so act quickly. Ask your bank about extra alerts on debits.
- 2
Expect scams that quote your real details
Messages claiming to be from Free or your bank that mention your name, address or IBAN may be built from this leak. Don't click links or call numbers in them. Go to the provider's site or app yourself.
- 3
Protect your phone number against SIM swaps
Ask your mobile provider to add a PIN or extra verification to your account, and prefer an authenticator app over SMS codes where you can.
- 4
Be careful with your date of birth and address
These can't be changed. Treat any call or email that asks you to confirm them as suspect, and check your credit file or equivalent for accounts you didn't open.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they appear in a new leak.
Frequently asked
Was I affected by the Free data breach?
If you were a Free customer in October 2024, you may be. Have I Been Pwned lets you search by email address. A free Serus scan also checks breach databases for your email and phone.
What data was exposed in the Free breach?
Names, physical addresses, phone numbers, genders and dates of birth, plus IBAN bank account numbers for many records. Passwords and card details were not accessed, according to reporting on the breach.
Can someone take money from my account with my IBAN?
Free said the data was not enough to make a direct debit. An IBAN alone is not a withdrawal tool, but it can feed fraud attempts, so watch your debits and dispute any you don't recognize.
Should I change my password?
Free's passwords were not part of the leak according to reporting, so a change isn't required by this breach. Changing it is still harmless, and use a unique one on every site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
