Free ISP (France) Breach Exposes 13.9 M Customer Records Including IBANs
What Happened — In October 2024 the French broadband provider Free suffered a data breach affecting 13,926,173 accounts. The leaked dataset contained email addresses, names, physical addresses, phone numbers, genders, dates of birth, and, for many records, IBAN bank‑account numbers. The data was posted for sale and later released publicly.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of insufficient data‑protection controls around personally identifiable information and financial identifiers.
- Continuous control‑assurance programs require documented evidence that encryption, access restrictions, and retention policies are enforced and can be demonstrated to auditors.
- Mapping the breach to a single control objective—protect personal data through robust classification, encryption, and monitoring—provides a trust signal that satisfies multiple frameworks (e.g., GDPR, ISO 27001, NIST CSF).
Who Is Affected — Telecommunications providers, French consumers, any organization that processes similar personal and financial data.
Recommended Actions
- Conduct a data‑classification review and ensure all PII/financial data is encrypted at rest and in transit.
- Validate that access‑control policies limit exposure to only those roles that need the data.
- Collect and retain evidence of these controls (configuration logs, encryption keys, access reviews) to support audit readiness.
Source: Have I Been Pwned – Free breach details
Technical Notes
- Attack vector not disclosed; breach appears to be a result of inadequate data‑protection safeguards rather than a known vulnerability.
- No CVE associated.
- Data types exposed: names, addresses, phone numbers, genders, dates of birth, and IBANs.
Source: same as above