French ISP ‘Free’ 2024 Data Breach Exposed Almost 14 Million User Accounts

• French ISP ‘Free’ announced that millions of user account details were exposed due to a security lapse.
• The data breach occurred in October 2024, and the leaked records were added to the HIBP breach service today.
• Hackers initially put the stolen dataset up for sale, but it was ultimately leaked publicly.

French internet service provider Free, one of the largest telecommunications operators in France, experienced a significant cyber intrusion in October 2024. On May 27, 2025, it was revealed that it exposed the sensitive personal data of approximately 13.9 million customers. 

The breach occurred via an internal management tool used by the company. Hackers initially put the stolen dataset up for sale, but it was ultimately leaked publicly, amplifying its impact. 

The compromised dataset coming from the second-largest French provider features a broad array of personally identifiable information (PII) according to Have I Been Pwned (HIBP), including:

• Email addresses
• Full names
• Physical mailing addresses
• Phone numbers
• Genders
• Dates of birth
• For a substantial subset, also IBAN bank account numbers

Such a wealth of information heightens the potential for downstream attacks, including phishing, targeted scams, and potential identity theft—even though Free has clarified that the leaked IBAN numbers are insufficient for direct debit transactions. 

In October, Free fell victim to a cyberattack orchestrated by an unknown threat actor who attempted to sell the stolen data via an underground cybercrime forum using the “drussellx” name. 

Back then, the French ISP acknowledged the data breach and stated that passwords, bank-card information, emails, SMSs, or voicemails were not compromised.

Outside of France, the Movistar and DIGI ISPs suffered continuous disruptions in Spain concerning Cloudflare infrastructure, reportedly due to targeted blocking, and Altice was ordered by a Texas federal court to disclose the identities of 100 subscribers accused of pirating music via BitTorrent.