Free, the French internet and mobile provider, confirmed a cyberattack after a seller advertised customer data on a criminal forum in October 2024. Reporting describes 19.2 million customers across Free Mobile and Freebox, including the IBANs of 5.11 million Freebox subscribers, in a dataset of around 43.6GB. France’s data protection authority subsequently fined the company €42 million over the breach.
An IBAN Is Not A Card Number
A payment card can be cancelled and reissued in days, with the loss falling on the issuer. A bank account number is the account, and changing it means moving every standing instruction attached to it.
An IBAN also supports direct debit. In a system where a mandate can be set up on the strength of an account number and a name, five million of them is a fraud input rather than a contact detail.
A Regulator That Fined The Victim
The €42 million penalty landed on Free, the company that was attacked, for the security failings that permitted it.
European regulators do this more readily than most, and it is one of the few places in this database where a breach reliably produces a consequence for the party that held the data. France Travail was fined €5 million on the same principle for its 2024 breach.
Compiled from the company’s confirmation, regulator reporting and public coverage, listed below. Record and IBAN counts originate with the advertised dataset. Later reporting cites a higher affected figure in the regulator’s decision. Corrections: corrections@forensicpost.com.